{ "Event": { "published": true, "date": "2025-12-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-09", "timestamp": 1765324981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7ed17be3-828c-450b-8cf0-56c7348c6129", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0494a2c2-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307554, "uuid": "c8325a36-e737-4923-b483-e9279943a473", "comment": "Malware payload (Mirai)", "value": "ed874e292f1aea6803acb8b74bcfa3b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307554, "uuid": "0548fe76-d087-4d7e-b6bc-d8bf0f8e8215", "comment": "Malware payload (Mirai)", "value": "01f007821935462819bdd4362f4988a6630441039b6aa520010241c59c738d91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307554, "uuid": "3192079c-f79a-4d4a-a2e3-c8116f9958f1", "comment": "Malware payload (Mirai)", "value": "6069ad16c46eb39d0cd0d681c18ec6396609696a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307554, "uuid": "f7f968b7-28fb-4517-8163-519a6959719d", "comment": "Malware payload (Mirai)", "value": "315b88568622eaba406876a463bc6629a155ca6c2cb66718d2fbc9d904315d941ca4f7075ab9b926aa8d9848ead45e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307554, "uuid": "375bc8d8-1a8f-44bb-808b-821f9babafe0", "value": "T117B312706929C9D3F351DCB39EBF95C7032321BC65CB420B91BE9B255AAAC52137C1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307554, "uuid": "d0ec7522-13b5-4f62-8c09-f79d76504256", "value": "3072:10nsIy5zQN2qIaRxpNXeBU1ggTAJud2Lv8cTRkkvn:1XjR+2IRxr1ggsMd2LpTvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307554, "uuid": "4520da16-508d-4309-9fcf-98367f850573", "value": 109960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307554, "uuid": "da11e8c2-c7f4-4855-a683-daabcba2eab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307554, "uuid": "12260be8-37e4-4d65-be9d-ea4ef123321e", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5c469f-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287914, "uuid": "6fdd3ce4-248a-461e-b6c0-57fec4902192", "comment": "Malware payload (Mirai)", "value": "8a8a6856e0b2d6c3d3e002c8fa66a0b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287914, "uuid": "2d3f9ba1-3574-4f75-99ef-874b26fbd980", "comment": "Malware payload (Mirai)", "value": "0228cbeda0532a47585e274f83f388a9d800059701efad6dd778cfae051cc8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287914, "uuid": "27dd5efd-a6b6-4e2f-bedd-124fb6605233", "comment": "Malware payload (Mirai)", "value": "ee185b55a24efabfff55c3437be8051bebbc5e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287914, "uuid": "b5abb339-e513-4e01-ba68-c2ff319694e7", "comment": "Malware payload (Mirai)", "value": "c88a86955dd826afb66ba92d0830b0859e681216920a15a60f8795833d053ac08bf3508a7de27a23a734192e4c888a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287914, "uuid": "6e169f12-068b-4ff7-b969-f0cfc766fb85", "value": "T12D93E71AAFA61FF7EC9FCC3755A8170520CC950A22A93B76B538D818F68F10B55D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287914, "uuid": "5ecb8325-8064-431c-b7de-42f72d8f5cfa", "value": "1536:BVHML1ocnptO0lmb05O8NhM6aAV40LQuGd2kRRaNJekY65FrZyocH:Bg1ocptO04owktsIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287914, "uuid": "4c770449-a370-4654-bfce-0705152d5477", "value": 96468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287914, "uuid": "0973b42d-5bfc-40e4-a3a2-b3faedc0962e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287914, "uuid": "c59c9da4-65be-4628-808a-be4fc89ccfe2", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e97541a-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298605, "uuid": "ad085bf0-2ebd-4c62-b7ec-d2e58cf6d6bb", "comment": "Malware payload", "value": "f89f597fca01d8f80b951db5f90dc041", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298605, "uuid": "e3f6b4ed-b9e2-4136-adf6-cccc89a41cc5", "comment": "Malware payload", "value": "023a4e5299877def26470b6340a243541588d0e12d50cd63a3ca8ed4411fc262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298605, "uuid": "4c004e04-b1c1-43bf-bb65-0684796bb760", "comment": "Malware payload", "value": "014f20d15eea7e233308e7bd378600f1c2d43095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298605, "uuid": "f955028a-59c3-48f9-a10d-96a6f889e049", "comment": "Malware payload", "value": "cb847427cedfc48e931b886a81289173b03e65e45410d5380d4282a14101e189b2f47950665a4de552dae47b8faf96ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298605, "uuid": "9614d2dd-115b-4ce3-a85a-003cf62c3054", "value": "T1C863F886B9818A55C5D512BAFA2E51CD331317B8E3DF7313DD106F647B8A82B0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298605, "uuid": "62f11715-8752-42b7-ba50-a9486ec088d1", "value": "1536:jRnABphhYKhAY7m6lf9aA0zYBikKECbpMRiIWKfOVCT3bsRQ:WDLYoBH0EBiiWKfOVCT3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298605, "uuid": "ea55bf9c-67ba-423f-8a4f-19957c3c00e2", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298605, "uuid": "ce329dd0-3d16-400c-b37b-702cf5ed7a3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298605, "uuid": "e1ee222c-9ada-4eec-aee4-2183b18942ee", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ef3e2b-d4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765267471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267471, "uuid": "7e1f6b91-af76-4897-81b1-36e1a76b83d0", "comment": "Malware payload (NetSupport)", "value": "448678937ea662ae54b062f805796b38", "object_relation": "md5", "Tag": [ { "name": "69-164-241-252", "colour": "#22FD2D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lucifer-now", "colour": "#B72DDF", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267471, "uuid": "ad8fdcd2-75e6-431f-bd78-d4a0e3d4696a", "comment": "Malware payload (NetSupport)", "value": "04143abe910988dabc52d44faa5f6afac1618f04828f799adf30e255e8221c7e", "object_relation": "sha256", "Tag": [ { "name": "69-164-241-252", "colour": "#22FD2D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lucifer-now", "colour": "#B72DDF", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267471, "uuid": "f824e606-f002-44c3-a324-3675ec35e0aa", "comment": "Malware payload (NetSupport)", "value": "0ca7f289c561d033aaf4a32eee6518529d1b2eb4", "object_relation": "sha1", "Tag": [ { "name": "69-164-241-252", "colour": "#22FD2D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lucifer-now", "colour": "#B72DDF", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267471, "uuid": "d788d0f6-ba63-479a-8b00-aa09317df83c", "comment": "Malware payload (NetSupport)", "value": "30a190249c93f701e13f578394e34b101eae89f1fbdc9613f281fe6f71a7b78a7d1f5ccd2f9d18776798cbc272d2c16b", "object_relation": "sha3-384", "Tag": [ { "name": "69-164-241-252", "colour": "#22FD2D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lucifer-now", "colour": "#B72DDF", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267471, "uuid": "f8e55065-881a-4d9e-a467-3d2567997740", "value": "T168A2D112B29D7562FF7596B524428A004FF3B84F53DF1490EAD4D8E9BC751780BC3856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267471, "uuid": "f838b7db-9d61-4dd2-97a0-280381f37348", "value": "384:i2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfwsE:i2+x6TLKQXK1myQCSr2VS4jTXaRnPof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765267471, "uuid": "edc8523e-3b3e-4a39-9321-4e1e7493a00d", "value": 22147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765267471, "uuid": "9c6d8470-5de7-4276-885f-083aca6a3dc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267471, "uuid": "65c3f57e-6593-4892-aed7-d6c2dd0ff2b7", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b078c5b9-d540-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765313426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313426, "uuid": "16eb027d-20b2-4579-a8a6-3125f48e5f01", "comment": "Malware payload", "value": "5c7d8bb12cdc3733137f8a122f7f3c5f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313426, "uuid": "190da2c3-0d07-4f5b-9618-da211bb365ac", "comment": "Malware payload", "value": "0419804060bfcc8ef10c09ff0d2d016d16722f599201c81d27898eecc3d7a1b1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313426, "uuid": "a9cb78d1-60e5-4404-95e0-dcb3b1089e43", "comment": "Malware payload", "value": "9a34cae032bf8de6150f5478a8cbaca204606d3f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313426, "uuid": "d4758f41-6aa9-4079-abe0-1cb2f4f5596e", "comment": "Malware payload", "value": "ff8e5a9c5b69326673d80e1623121e2f013c052e80fc7e9f6bf46d06d583f1010b1bc178b5a8048a22fcbfd1ba161f71", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313426, "uuid": "d5a2dc1b-a992-4351-a0d8-c2cb9820a02d", "value": "T10501230ECA1159F48B1674A24AA21C0693C7E0AAF2E8AB304900C46F0C4B19A2D146DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313426, "uuid": "80dc0204-2d76-4078-81e0-c420d3f270c4", "value": "12:qxcMoh4vmAbs1vWdEV7wsWXOCBEg5fbSJiVmse8awmjHJ5x5d8e94vHYiajteS:acMoAhbs1Aw+DSJD8Vmjvx7v94/YvteS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765313426, "uuid": "06346728-1b29-444e-bbec-f27caef181a2", "value": 668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765313426, "uuid": "9fb276c2-40ec-4109-9a22-308f1272d5ff", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313426, "uuid": "3a6bf939-6403-4d12-876b-0d6ebde8e934", "value": "PROJECT 3D SAMPLERS DRAWINGS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5099a12b-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298233, "uuid": "a1def15a-122d-4d4d-b01e-188ead118509", "comment": "Malware payload", "value": "ed8638f585ade5fcb3a6f66655e27382", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298233, "uuid": "fc1f96ae-70ee-4d28-97c3-fa147f200625", "comment": "Malware payload", "value": "04660d5accb2823595963492c25104da03966c5e36933dff599327daa399606b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298233, "uuid": "4e103717-fbca-4ea0-ad88-32e541e4922c", "comment": "Malware payload", "value": "0e0e17acf9ba54f25e52cd7f88362724085075f0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298233, "uuid": "141924fe-c66e-4756-9778-ce3c77339e32", "comment": "Malware payload", "value": "971f562b1bb1a278ea1335ab70ace10caa7b5a0ef2cdaa753e6a70673264d22f384b798d982b0bb984f85ff36eed78a4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298233, "uuid": "d1930bfd-ed12-42c4-a736-fc9142281380", "value": "T12FB61882BA454926C55BF238EC7152157731BC4943312ED76EEB06A90CEAFC4273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298233, "uuid": "2685faa4-e267-42a4-8ff7-95ac53204033", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298233, "uuid": "a84aa20b-9a22-4389-ab8f-cbfd6475dbc8", "value": "49152:TK73uSQ3oOSKwJTOMoqGT6VxQWe9fs5OXXqgsmA:C3YoO4Jqn9E5AkmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298233, "uuid": "7cee36a1-adbb-459f-a2e8-88966d89e811", "value": 11197496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298233, "uuid": "8c68c96c-6cdc-4af4-9b74-c719f4b26b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298233, "uuid": "43544c9f-dcac-4185-acc7-16ecbc8f2af3", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b333fb71-d509-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765289808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289808, "uuid": "aa8ef91a-319f-46f4-962b-4ddf24ce8128", "comment": "Malware payload (Vidar)", "value": "e7e938b037c93f255eb1f5bd35bfafb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289808, "uuid": "9d1f6d80-daaa-413b-b4a1-84bd64b29d31", "comment": "Malware payload (Vidar)", "value": "04ff3383d30ed696e29c911047090b1ac63f430a6a37aa15f87704fb5b8173e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289808, "uuid": "4a962ff0-ff68-4e8f-a560-9ae5123ea657", "comment": "Malware payload (Vidar)", "value": "57ddd2b5eacb8581f076bcafef16a31ecdf8798d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289808, "uuid": "7a99ef40-2be8-4d10-8eed-67b3c92090d3", "comment": "Malware payload (Vidar)", "value": "1b51fdc5883afc6dc86d7de283825cf4f12d0412d9e0af456046244e9fb4bb7c30bd39b41f3392edb0ab65607f546a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289808, "uuid": "1b1c88d5-ae2d-4843-822e-e05e7d27ce2f", "value": "T1D9B63B92FA814629D56BF2349D70626573317C8503313AD7AFDB06654CEABC4233FB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289808, "uuid": "7e93f981-6019-4641-bf6b-faf3ac39f2a5", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289808, "uuid": "2f07c1b0-ab3d-438a-913d-2cd02dc9fb30", "value": "98304:1I3teoamCQpU/LwEZ4yuMVhWlk3kcsxHoLdjddcUwbw15GMWnrZXxSLURfaAqipl:1wwoaV4UqvOmdOCeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289808, "uuid": "07e927db-e452-4a41-9508-4e2b283b0463", "value": 11208448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289808, "uuid": "ae89d96b-7492-4df5-afdc-3ba738cdc432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289808, "uuid": "cb174b99-e2df-43e1-9bd6-70047dc4abc1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acddf1ce-d518-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765296240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296240, "uuid": "eef16456-cd49-4b16-aac5-104c74c21202", "comment": "Malware payload", "value": "3f267b62350803264160e3cdbb3ab134", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296240, "uuid": "835d54b0-73e2-4b00-947e-534b4f3d0f47", "comment": "Malware payload", "value": "062bd9a18ff847c86217d89ff6956a7e84ecd4244ba3a4feb9e2c1ded2cb9407", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296240, "uuid": "aa29fc0c-51c3-48ae-95a4-e8931e83d4ba", "comment": "Malware payload", "value": "5a37ebd999498e68c55339d2c0c399a265ee84c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296240, "uuid": "11c62a1a-19c0-4f4f-8522-8d78adfe6e8f", "comment": "Malware payload", "value": "b1c289829180955697dce637313cbf94df0c701d828f511b448ee63283d417704392dd42392bcacf577ff35530c6d8f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296240, "uuid": "47c492a1-6e16-4a94-a179-75c930554c71", "value": "T136F1D712FBE84676E53B0A32187363408779B366DD13CA1E5485610B9FA33554AA2FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296240, "uuid": "3875682b-4a49-45d7-9ba6-c49ab312b125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296240, "uuid": "09711b0e-2497-43a4-bcff-b67372e5ad07", "value": "192:wY0sSWwQ3YdLVTLu0cdOkLeLKeOkrwSlCnxj1ha5k:R0ZQIdLxLjcdOkLeLxr9Cnx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296240, "uuid": "30e843cf-4729-4428-b635-3afa24c41731", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296240, "uuid": "3ed278f2-19a5-478e-9249-0f2526be8e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296240, "uuid": "d5e616dc-0736-4b52-b9ba-f6e208042dba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa05012-d50d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765291539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291539, "uuid": "35e0ade4-3107-4740-b24c-7d706db1ae9d", "comment": "Malware payload (Vidar)", "value": "77e25d244e97ea4a74eec30c42e6238e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291539, "uuid": "fd9748bd-cb29-4d27-b2d0-72b0e0f7606e", "comment": "Malware payload (Vidar)", "value": "0677b9cb1ea64d4a3c9d45f12ff56c8bab7a45a22656dc203299034533c6dfa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291539, "uuid": "a5628a68-6f8b-4cb1-bac3-00c91ad12bac", "comment": "Malware payload (Vidar)", "value": "9fdaddd5fe46d45f45cb1927a00e306b9bc282e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291539, "uuid": "6d58adf6-81c9-4d9e-9239-0f7fd6cd319b", "comment": "Malware payload (Vidar)", "value": "c52b9addd55fac70dcb85368361d79ab4f02f027d9d9cbd1dcf05877ba29243d0058d28d4907360106f50c54dbb434fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291539, "uuid": "6aa27460-1d35-423f-ba0b-5051ba2bacfe", "value": "T179963A82F9514629C56BF234ACB162517372BC0443362AE76FD716790CEABC4273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291539, "uuid": "4811f8fd-ce71-4a78-bb4a-bb91b9d0800f", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291539, "uuid": "8b5a27a9-3e6d-4857-9079-268d73e283cc", "value": "98304:Z83KNKtmlR1otqdituWgiGAC64K0WoxTeN0:ZMtwJolGAv0LRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765291539, "uuid": "be797349-cca0-47b2-86be-53ad836d293a", "value": 8968880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765291539, "uuid": "f0190b42-228c-4fed-a417-6c368eb8a6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291539, "uuid": "23de6b97-1b64-4381-aaa9-58e8ea5c0361", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d420acd-d52c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765304777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304777, "uuid": "7a0a1e6e-333a-4c40-8542-550c57dc6b4a", "comment": "Malware payload (Mirai)", "value": "b32e96e1e33a885416cf137a9961f890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304777, "uuid": "a4ffad65-939d-457c-953e-3b21d0f7e86e", "comment": "Malware payload (Mirai)", "value": "0771d55615a340688e26409182cd7469fd77002d1966774862437c8c674409b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304777, "uuid": "b28d77f3-8011-4841-8374-c37e1c0edb7c", "comment": "Malware payload (Mirai)", "value": "43c13aa9012bdf51052044efb1ceacae2db56ae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304777, "uuid": "121964b1-93e2-40dd-8471-fb771898b69e", "comment": "Malware payload (Mirai)", "value": "0ffcb5bcc690a603568b15071f10e050335521f1a77e51cdbedfe99bc2febf495426c4250ac244fd1b412e62b8201f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304777, "uuid": "fb7d0aa4-8b2b-4fa4-81d0-7d39feebd5d3", "value": "T1B0743B46E9418E23C4C11BB6F6AF4246333397A5D3E7B2029E285FB437C765E0E67642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304777, "uuid": "613e829c-6a33-43f1-b08d-54241015b8ca", "value": "6144:9Boh1LT7X/jp3hr0ZS341GszqJIHWdkrSxA/+9u04/0jxTzm9amPtTWLyyZUf3Ey:9m/LT7X7p3hr0ZS341GszqJIHWdkrSxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304777, "uuid": "94f0da5c-bbdf-4e72-9d25-8773454eb72f", "value": 346463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304777, "uuid": "a7d5177b-333c-4be5-baa1-1368b4e467f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304777, "uuid": "1f21b6a1-c9a5-48cb-86fe-84032f807ecb", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0d4ea6-d529-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765303297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303297, "uuid": "ae639e5d-988f-4994-95a6-78993dd60e6d", "comment": "Malware payload (Mirai)", "value": "2b486672934b0bdbecbf33aa30e38300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303297, "uuid": "5d92a3b3-5880-453a-a657-8a9750a5b490", "comment": "Malware payload (Mirai)", "value": "07d4bd46af62e90320888dcfe88a1bb185d4742b592efea1aa994083ed228e0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303297, "uuid": "4b8d8715-0b47-4978-9582-c6de75071655", "comment": "Malware payload (Mirai)", "value": "fbf76d5ada0922a926e66755e96d9e4ab1b4a194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303297, "uuid": "59391ca9-145a-4072-ace4-bb91d9e174ad", "comment": "Malware payload (Mirai)", "value": "fb9dcd2ece4bc14ae3299ef455065dfc838f04aff05f836a5986aa91fb0f878963e0e2718667036479dc75dff03e2f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303297, "uuid": "629805bb-be0f-4693-8926-efb54091030e", "value": "T1DC63F985B8919A17C6D462BAFA5E41CC332613F8D2DF3207DD11AF157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303297, "uuid": "43743416-8697-4236-aa73-46aab0e2b3f3", "value": "1536:WSj+CCASsTpfXMIsTjxLRxB8oDufFTjU/yvT3bsR:pj+CCHTjlRIoCRYavT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765303297, "uuid": "c64b9615-e924-4f5f-8e59-d686a418563e", "value": 66720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765303297, "uuid": "b0afe794-d05e-4c93-bf35-436da7b10bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303297, "uuid": "a883c24a-ade6-4627-a22d-3d2b8e750671", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70df04-d540-11f0-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1765313478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313478, "uuid": "447708d7-c906-4ec2-b267-a878c6f5c871", "comment": "Malware payload (Loda)", "value": "577a2016e6b702063f275a8124ecdc07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313478, "uuid": "bf4a7f78-52e7-4eee-8183-5c8958a45119", "comment": "Malware payload (Loda)", "value": "08b02fbddee7bf40f03f3298c62d491eb7f290946d242740a05f6a9f6bd233d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313478, "uuid": "4078b506-2f20-47a6-bb68-e00e1d5b4800", "comment": "Malware payload (Loda)", "value": "fd65618660a2b3357aee28aa227d994c2090d1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313478, "uuid": "4b5decc4-2786-4630-8c1d-900ba71df0f0", "comment": "Malware payload (Loda)", "value": "2873a13079facdb40686afdde59b243b84dade7c462638e04a0a799aba124b105eab276030fe5c8e638e7147570ff62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313478, "uuid": "c06bee61-2845-437f-b276-42bf18af6d34", "value": "T1C375CED2638C82A0C6735173B936B753AD77792D4DA4B45F2FC52E2EBD20322421B963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313478, "uuid": "9e9a9a33-e39c-4e14-be66-4f1eba45fba7", "value": "f2da2e4c1b5a39d16c40d60cec2608d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313478, "uuid": "c9f21252-2e0b-4c07-b1f8-9185575dc922", "value": "49152:3kwkn9IMSNYKA0OOKf4ZC4NKpDA3BaPCS:UdnsrXKfOC4NBEPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765313478, "uuid": "38dc509e-6071-47c7-8b0a-6fd33ed3e67e", "value": 1578496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765313478, "uuid": "fedde58a-640d-4dc4-801b-ac17ab687810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313478, "uuid": "de815c42-90dc-48a4-9ae7-c89c72df0e5e", "value": "DXZLFK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c70202-d492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765238813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238813, "uuid": "564e15f2-7f6a-414c-89d2-a2d45bc77ad1", "comment": "Malware payload", "value": "8ec8c8f2e244d7fa895f1bbee7d3a51f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238813, "uuid": "a0ef820b-60ca-48f9-bdf3-74ad4327377c", "comment": "Malware payload", "value": "08cebca66dcce4751e0125225c0882195a23b0553101e12fd39940b6c4fdc5fb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238813, "uuid": "d3ce30dd-40ef-488a-8c21-339605da069f", "comment": "Malware payload", "value": "5e7a0e4793659a4b886e100725416c39e1f9b779", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238813, "uuid": "69f36efa-f3c3-47fd-bdd9-8b194d09bf02", "comment": "Malware payload", "value": "7c3dd31eda3777c86e558f88c71873e0c2244e0ed13c719584b8c5f6baa07a4a9a76bbd1a4792b12a0c6fb8a022e5c6e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238813, "uuid": "b9044e00-6764-4189-8796-6fb12697a743", "value": "T1FED42358B5F36F91E6D02EEF601B354535B36DF0B87302888E3370DB911E56DAC85AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238813, "uuid": "4e7e7e84-0a81-4cd0-bcb5-370838117005", "value": "12288:EiVRQcfZQxcWPhtb24IX6YHxdkkt19jZ9EDjRQXXtrXY9YswlmS:Ei3wtb24IjjTt1hZ9EDjRKKGllT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765238813, "uuid": "202f717d-5da5-4a23-86db-c91d7d2bffb0", "value": 604484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765238813, "uuid": "777fde0e-d758-44fc-86e3-fe430a940044", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238813, "uuid": "0e636bbd-930e-4cae-bf1b-3ba5e11d34ac", "value": "Dane_do_umowy.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7792d14-d510-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765292849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292849, "uuid": "0ea96c94-6764-4169-8776-49e3405054b4", "comment": "Malware payload", "value": "20473462aa36297ef278f532b0187b39", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292849, "uuid": "23d46842-55fe-4fa9-8a6a-4776ffffc4fb", "comment": "Malware payload", "value": "0906ee7e30628278272cecc1de1513d093d8455e72ee1a71da5d774df5e17ff2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292849, "uuid": "592039a2-13a9-40fe-8583-7f7f5c46dc3b", "comment": "Malware payload", "value": "1b6a501a41585c851268dadb6203571f37a2f14f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292849, "uuid": "a9803477-5297-4698-8edc-7c99ff2f868c", "comment": "Malware payload", "value": "f11033e89ff75f51d33e4ae49a91c1874973d90f9e362ca07022c5b51078725bb8ef88e489b2b6fa65e7681e0c56dd53", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292849, "uuid": "6947383d-beed-48b6-a223-1e48c7a37895", "value": "T1367733ECD84507CFEC734A34E0B9B211CA6ABC415966CE362965775335BBBF0A1BC10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292849, "uuid": "0f793884-5916-45cc-8292-0c0fdfe35b7d", "value": "786432:1ezHV1H3djXFV7vxxFiYWeIjRiwE5WTKDMsD2RgIAYXI6ycx3/Xh93:8zH/djXFVDx3iYbIjMT5OijD2f46y43r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765292849, "uuid": "0c17892d-2098-4d8c-ba8d-5a9a6a10ff0c", "value": 33550336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765292849, "uuid": "5310cf63-1a60-4349-a5af-e9ad1bed50a7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292849, "uuid": "c6ffca65-529f-497c-b563-25e509c8559a", "value": "External 2.4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b403c024-d4d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765267476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267476, "uuid": "23aa41f1-0a8d-4891-ad97-2e513a701120", "comment": "Malware payload", "value": "0830fa2b7d645db21166c5a4f18c2754", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267476, "uuid": "ba3b3e87-6fbb-410e-9562-7089786d0693", "comment": "Malware payload", "value": "09987e069e55f2823445bc411cfd2c36d09a6642205f3471229486bd724e6d71", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267476, "uuid": "0fe63bf2-f800-40f5-bd96-3bf0f3ef3a29", "comment": "Malware payload", "value": "1dadb4a8430814867de5792823554a0c30818513", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267476, "uuid": "5cd31c77-a044-45d7-aeed-9b6e612ebb19", "comment": "Malware payload", "value": "da65f2fcb224a4852a9ac71327e081f70fc23d224ee77d2097ccea83d501738a1ef752645acaa3d1b71e664ee7066b36", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267476, "uuid": "a93bb110-602f-4b26-8e0e-43ae92d3617f", "value": "T16B76331463900AEBF9ABD03DCE92DD16E2B1B9180762CA9B07F0D5622F771E13739791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267476, "uuid": "a1060f8e-6640-43a6-9d92-3c455833260d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267476, "uuid": "46ee95ee-6251-422f-9dbe-647fefc36dd6", "value": "98304:nkMsgJS2u97uZhCMYkc6Z2000PGCpVfRwj73kq3ZrgUyAiRDxiSZt1q48+lS6ZqA:kJrF1urHI0xLVfUp3iUyu4d8M9qgsmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765267476, "uuid": "7ef42d43-eccf-40f2-b261-cef980284395", "value": 7254343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765267476, "uuid": "81e5dd8f-3d4a-477b-ad11-3d21afb6f7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267476, "uuid": "1d2a4b9f-e669-4801-951b-274ed22ea475", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3eca93-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307595, "uuid": "54854657-9e51-4b12-92c3-dedf9a9a09ce", "comment": "Malware payload (Mirai)", "value": "ea03f02e5555bbb52a098450e0067e5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307595, "uuid": "d2af22a6-8e1c-4de6-a144-5f3eb703f1c9", "comment": "Malware payload (Mirai)", "value": "09aa3df0913749e11f49c9465be5ac92a3fd8585bb1f87f649a63af6ad61c428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307595, "uuid": "00cb8d45-d6f4-4662-b75a-08140cd7eec5", "comment": "Malware payload (Mirai)", "value": "6616edb79a35afb5f2d824f12a432db72c40c07f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307595, "uuid": "25818997-4d0b-45a4-a07b-5c2690691594", "comment": "Malware payload (Mirai)", "value": "58051c5fe661f09907f463ebcd975ee3fbbdc31497986bf94d3e41e9fa9abd469ea940496fa8e2c3ff968f46231fcddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307595, "uuid": "dc28f039-de05-4ad8-adbd-cc42fa19a119", "value": "T19A643B86E9418E23C5C11BB6FA9F4246333397A4D3E7B2069D285FB436C775E0E63A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307595, "uuid": "fe3de62d-1384-4fa3-8ed5-207117ff6b5d", "value": "6144:J7X2eJDfxy93hr0ZS341GszqJIHWdkrSxA/+avhx4x0w3yoSeZaYBd2pfFBjOaat:J7meJDpy93hr0ZS341GszqJIHWdkrSxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307595, "uuid": "b5c36b22-a8a6-4a3f-aa50-53db94eea696", "value": 329243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307595, "uuid": "073e8963-54c7-4994-840d-3a052cf180ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307595, "uuid": "d8f77bac-9505-4c33-877a-4becec073745", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20c0513-d527-11f0-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1765302718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302718, "uuid": "89cef4c4-465e-4404-a921-e34525c87c9c", "comment": "Malware payload (XenoRAT)", "value": "0e212705ea4f7291fc042d6ebb6a628b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302718, "uuid": "a3b0a4b2-2254-4c7b-970e-c8b898477387", "comment": "Malware payload (XenoRAT)", "value": "09d01a2b34a8c11fd9104b3bb4d91d01af3856ce3bd3f311b48b62225c406037", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302718, "uuid": "d280b64a-fdc4-47bf-8875-1b1802971c64", "comment": "Malware payload (XenoRAT)", "value": "3ef5e301ff112105898846325965e3c8526275c3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302718, "uuid": "33d260f8-99f2-4e76-a2c8-a1dedc007a61", "comment": "Malware payload (XenoRAT)", "value": "d8a7d1dec85cde06e4bd5889992cd7b831eec063386d42044d2d3aad0074647adcda36592301b876320d87ee4d3ecd1d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302718, "uuid": "41fe990c-2f4e-44c7-a95d-8632da11bb34", "value": "T12923094C57AC8923E6AF1ABD98324263C7B3E3669532E38F08CCD4E937973855905397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302718, "uuid": "8e32aae9-f39f-4efd-a63f-a93e1784b7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302718, "uuid": "814bae92-f1b1-4bd5-b2cd-c47cc79e7407", "value": "768:kdhO/poiiUcjlJIn91H9Xqk5nWEZ5SbTDapuI7CPW5Q:+w+jjgnXH9XqcnW85SbTEuIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302718, "uuid": "db191166-481f-4fa5-886a-a3094919b167", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302718, "uuid": "49741d5d-cb39-4b3d-a9ff-949f40200371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302718, "uuid": "ef04821f-db4f-4c92-b7d3-c5a2f57c2358", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325c181b-d553-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765321375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321375, "uuid": "334d3849-9b73-4f8b-ada1-75952e845c17", "comment": "Malware payload", "value": "b968026518f43cdabbe06045a739870f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321375, "uuid": "903f9a77-aa29-4b72-805e-0f1daff0275c", "comment": "Malware payload", "value": "09e766b94875f58a28507ab993ea66c6f0a5996f9772635342c23eabe35d33fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321375, "uuid": "9b059db5-5383-462b-a9cd-9d7b2d60f559", "comment": "Malware payload", "value": "8b6fee7d4c8371cd4061e9fbca676ee52c4f721b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321375, "uuid": "be6a7d6b-2937-4ee3-9ec5-a12a4e1d4128", "comment": "Malware payload", "value": "2891bc360782db25df17c7569403aca58eb8fada8823bd908e6b8027d487aafd83d9fdac2da1b1c92ef301f8425621c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321375, "uuid": "d50aaff8-fb2e-4ffa-9c82-f2c928b09254", "value": "T1019354884D9B58A55F6F3068963F5E43AEED8103411CC8907ADFAE996F124F0B5F87E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321375, "uuid": "a85012c8-eaf2-4f3e-aaf0-12b35c0ad1be", "value": "1536:jT+gOZj8ZSoadzU89qgMBUemDcXJTR7Fq1exeUa6pWUsYM/HvO9A98vivyWyN2tQ:rHadzU8QHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765321375, "uuid": "c944f6d6-0cfa-46a1-ad11-d40f81dc8585", "value": 92552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765321375, "uuid": "ab727413-69a2-4c76-99a2-6c4070a89f3f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321375, "uuid": "d76264ed-a626-46d0-b712-864be76f3fde", "value": "Work_Y_Record_167.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5031c96c-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287924, "uuid": "ee6c4151-8fa6-455f-b633-15e9b29f32f7", "comment": "Malware payload (Mirai)", "value": "e2041f4535b7e6bb88a276938f4dba3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287924, "uuid": "4e0ba182-086c-45aa-b0a3-6769133e61fd", "comment": "Malware payload (Mirai)", "value": "0b3fd9b91b13010696591dfe46e2539bac6b465ed256df4a7ac90a2255b5c9cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287924, "uuid": "dc96837c-0bf0-4da5-9bc5-c8b0aca13b98", "comment": "Malware payload (Mirai)", "value": "0de8eef3123d3c705eaf497a129e2aed96b57043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287924, "uuid": "6ed93405-d030-41cf-8098-25ae25ee8faa", "comment": "Malware payload (Mirai)", "value": "28f451e03192f3f9d535b34d7720c699300081502ff1cac745d86af31f4728717481a49fc39b17971b98be29b2567798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287924, "uuid": "12e1f2c7-328d-49b9-ae2b-0dee20ee3cd3", "value": "T195630746B8918A11C5D513BAFA2E118D331763B8E3DF7212DE106F2477CA92F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287924, "uuid": "a98a568a-a76e-40a8-be3f-cdd57815a8a7", "value": "1536:ehnuTjsJ3XL+71DymsLxiMAzrMczKzJNVTfwPLMrPQcjSLUIXiVN6WZWP:eNXSpGmaZAsczKHV7wPLspN6WZWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287924, "uuid": "198acdf1-b393-4929-94fd-d9b47e298779", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287924, "uuid": "673871bc-8fa8-4362-8e7a-e1dee040f509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287924, "uuid": "86057ca0-979b-4000-99dd-8d0e5a9af28d", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90ac597-d50c-11f0-a129-42010a9c0007", "comment": "Malware payload (ResolverRAT)", "timestamp": 1765291080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291080, "uuid": "f2831583-d61d-4bb1-84d3-f2d884d4918f", "comment": "Malware payload (ResolverRAT)", "value": "7afa30350b5b75db348fdf47360a0166", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291080, "uuid": "3d3c3fe1-bb66-4ba0-bf33-136f7273244a", "comment": "Malware payload (ResolverRAT)", "value": "0bf636489b239160bcd7a08ded2f7f8ba0fecf881828794d141223533a912c23", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291080, "uuid": "bc6d4a3f-7cb2-4e7c-b214-55b26fceb822", "comment": "Malware payload (ResolverRAT)", "value": "eba85d3a046812d91bdfec14564300519482877e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291080, "uuid": "3180da76-a72a-49bd-8652-5b70f0a22b0c", "comment": "Malware payload (ResolverRAT)", "value": "44aad530ef204f6f1f99e1d0ff0c4ecf2e0a8c7aa5e47d77e805c3327f0000de5706ed1a758bbd8db25a60b018c1db7d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291080, "uuid": "2ac0a681-3e0b-440d-86b6-7c71c4d82d21", "value": "T132D62323B28E273DE07A4A364972A945553FAA61A11F8CA3D6F40D4CCF2D4601E6FF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291080, "uuid": "fb952f24-18b2-4576-88ed-6660e9a81499", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291080, "uuid": "86ba51a7-8e52-4e77-b2ea-cac3560885b1", "value": "393216:HDKX8q7o6NK9lvm7dW20hJnX/kBIrmvGfxKozUH2HbV2:4bK9lvwdn0hJvkKVfkTH27V2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765291080, "uuid": "93964196-e3b2-4ecb-92c6-6c736a27f471", "value": 12925842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765291080, "uuid": "0079c1ce-7007-4149-b76b-c1cfdaac1348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291080, "uuid": "c8b7a143-e0d4-407b-9b75-6278fc2746cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe17463-d50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765292031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292031, "uuid": "7e0d520e-5b1c-45e7-b0ad-029a526fe210", "comment": "Malware payload (Vidar)", "value": "9e4ef010e6100ce732c6307b236cc51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292031, "uuid": "7f5fd7a3-669f-4f93-aa97-f437c925252c", "comment": "Malware payload (Vidar)", "value": "0cc191ce9f62a36b15bae927276ae012d36065c64749c670cd1e376863d7b40e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292031, "uuid": "1b83ff4c-b699-4abe-974b-8230613d917c", "comment": "Malware payload (Vidar)", "value": "5e4bf3b574d576df889cc693e2929916582c9efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292031, "uuid": "054fb157-cdf6-4c9b-bd7e-a2904b0d5d2e", "comment": "Malware payload (Vidar)", "value": "87479ea8324542f5e7097582bada03811ba59b9f755e09b2aa7e9c4aabee3fb25ac7f14f029f90247d99ef658da90b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292031, "uuid": "8ff92d18-d026-4b40-81e3-b5d42ee62aad", "value": "T16D861942BD8D4669C67BF534A4B1623376787C1843302ADB6FE81669093ABC41B3FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292031, "uuid": "48e6fb3a-de58-4c7b-8d1f-d5e2d81973ad", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292031, "uuid": "3ced61d3-c89f-4063-a051-4031029f3b87", "value": "49152:lx1Q3m5ZFZ+TjqpgFYwe8C8dw5tMSCow7GZ379sNdtyBLAKmBH5eidUZ2SAaNVYd:hQ3mfFZ4GuF+52oht7WeB5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765292031, "uuid": "27e32caa-784a-4d09-8959-2218b654f715", "value": 8611968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765292031, "uuid": "b7e2cc47-3edc-4c86-9a45-a84bd013fd19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292031, "uuid": "1e789d47-1edb-44fe-981d-5f5ab01a9852", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405894d7-d508-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765289186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289186, "uuid": "7e147713-b6ab-4a48-b9d3-5018016709fa", "comment": "Malware payload (a310Logger)", "value": "66c50e3267d693303f6cbae5fdf25878", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289186, "uuid": "b342a696-94eb-4a8c-9d48-e54a1074aeb2", "comment": "Malware payload (a310Logger)", "value": "0d6f87aa1826205087affc7248276844f30898daa0eabad676c549459b8e8722", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289186, "uuid": "e7d830e1-b1b0-4021-8eeb-500c50e031b4", "comment": "Malware payload (a310Logger)", "value": "f366651aef1b829b39575a893be6dc03ac1d4a0f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289186, "uuid": "916fd03d-f512-4bf5-953d-d34fe6c48cc2", "comment": "Malware payload (a310Logger)", "value": "0579592ce75497facf273c695fe87c67ef3873741f3a50fcc2480e652fd55574b728d6f05b06c2079e0243da03bad9ff", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289186, "uuid": "a36bbf45-1827-47de-802e-c4b4fa38c9b6", "value": "T15F545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289186, "uuid": "89a5f32d-34d2-4767-b62b-8d2648994e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289186, "uuid": "1fbb7b0b-dd83-4758-bf6e-79d40458a892", "value": "6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUv:Hh6OTyejyThvFhIpQrAHYR/H7Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289186, "uuid": "762b2cc4-36df-49d5-873a-7f259661fdae", "value": 303617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289186, "uuid": "f35453f2-28c9-4cab-9ad1-b61d2ad0b883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289186, "uuid": "ab3f95f0-204f-4b3d-837e-6f2aa3844f54", "value": "Build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9520ff43-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264417, "uuid": "f9da0146-61e0-403d-aa5c-fe79e2b91fd3", "comment": "Malware payload (Mirai)", "value": "757fb8a0297941c31ca212756e35b7f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264417, "uuid": "351f6595-5de6-4b09-a008-9c810a577765", "comment": "Malware payload (Mirai)", "value": "0d8a1c820dbce84c6304600e0034214202edba954a1ff0e8f3d6019a350c1c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264417, "uuid": "023b80de-1c00-44cd-8eb8-0944f811129f", "comment": "Malware payload (Mirai)", "value": "efe32f8d659efd8d52d90e4e3a031c60f92c68bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264417, "uuid": "5c0b61a9-827e-4cff-8ed6-a713c19c5c85", "comment": "Malware payload (Mirai)", "value": "0e1f328fb1d9407d2342d9195abca747a79aa8fa877dbbb4ea29602b55817c52cf30f75c965f651fe40156f9b83cf3c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264417, "uuid": "13e3ef8c-cd06-4cb7-85b8-84f082af4472", "value": "T103F47D623721DFA5D354C27005F3C76156E520A21BE2908AB27CC7287A61A2D6D6FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264417, "uuid": "41fa6c84-0bf7-4b09-88b1-391709f53471", "value": "12288:qUEWAff4tcnyYZ4ap9SFvwJK1nEwBw+wyLKjiuqKEz08pZooG8+xCIokY:qUEW+f4tcnyYTpYFvwk1nJeyLkijKEYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264417, "uuid": "9ece1765-a2d7-43ab-8a5f-af42cbfa6713", "value": 755620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264417, "uuid": "389ac9ad-8e51-49e3-a8ac-e09d062e746b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264417, "uuid": "c8edf473-7cb1-4ef9-812a-dc5531d2e74d", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40dedd1-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765248122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248122, "uuid": "3af2cf8d-3453-459e-8a09-dfb76719b5ac", "comment": "Malware payload (Gafgyt)", "value": "4d239af97283e052de11b2b2547d3866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248122, "uuid": "5c154ad9-b960-4ba8-8bec-48c9562c5399", "comment": "Malware payload (Gafgyt)", "value": "0dad2706685517f94f0c628f83fad5da211a30ea0621a032a467c958bd2efb66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248122, "uuid": "63299923-5c63-4371-8e39-9e0a9da9f432", "comment": "Malware payload (Gafgyt)", "value": "6379ed07ec357531b983e4b2dc2219f35ff15eb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248122, "uuid": "8d416ecb-6171-47a4-a2aa-4b15fc8a615f", "comment": "Malware payload (Gafgyt)", "value": "9628c69063f925c73aedbf06fc92ec0285b79335a4e78c208152bfe6107f627bca095c52ab06531b19400d5762a0ad82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248122, "uuid": "b9ea9cf3-d365-47d1-90a9-bafbabf2d6c5", "value": "T1D60441EFBF1C43DFD64F02B8292663E00FE89561139051C2F5999E420FB3179A92B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248122, "uuid": "f71b2962-74d7-4734-8269-dec9efa4b633", "value": "3072:ppq5LY0yXjiLX9K2cwsOqxY2X+29FrGStcOsPHs0aozetKNX:ppq5m69LcwsO01XB9XpsPHs0aozetKNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248122, "uuid": "69962ffc-ad4a-48cb-8243-a3de5406bb97", "value": 189745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248122, "uuid": "7fc6ab66-3093-4408-a778-11c56b473de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248122, "uuid": "3aa2048e-55f9-4a0b-828d-30c9944cc2dc", "value": "Demon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7d383c-d520-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299707, "uuid": "b8391654-8415-4c00-948e-0ea792a123bd", "comment": "Malware payload", "value": "d60b3a2ded04775ea8af0f67b19980e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299707, "uuid": "d33efb4f-c698-4cb7-9c27-39c8823869ac", "comment": "Malware payload", "value": "0e03049b7a83de80b9c6ebad283e55dc9e35a5607dc7bbe05843ed7dee17080e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299707, "uuid": "8a691f53-5133-4b5f-bf7c-528036f821cd", "comment": "Malware payload", "value": "cf47315364a51eca2c0541eaf25d4f77c8124f54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299707, "uuid": "3839fb7c-1c6e-4a42-b6dc-ef75abac5306", "comment": "Malware payload", "value": "6e0821d507694f23a0390038054f60b6158b3a925fc2f6058ca81e3079499fd92e7c60184ed51f2fd8aebff2d61522f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299707, "uuid": "2ac7a2c6-8188-4702-9998-60d3e873656c", "value": "T160438DB6C469ADD4DC4812B4AC318E769B03A100D6561FF75F9AC4E98087EACFA4D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299707, "uuid": "089ad3f3-1edf-4bab-b338-409c16a53d28", "value": "1536:AaXwtfzFKiYf5kHbwJRdb1EI5UWC5okMdZCjxT3bsR:AwoFwfikP6RWYoddZqT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299707, "uuid": "6b38a716-2aa4-4452-bb30-18722df8d840", "value": 60028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299707, "uuid": "52429638-5d5b-419e-a91c-70ae8eb63ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299707, "uuid": "0b9404f7-bb0a-47d1-b775-ea770ed0b6eb", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e29e1a-d4ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765262751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262751, "uuid": "cc80bab5-6a66-4141-bdc0-8aedec5ee08e", "comment": "Malware payload (Vidar)", "value": "43eb6a51082955ad2d591a9d4c5fc8d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262751, "uuid": "bc23c23f-ce57-407f-844e-45885a91662d", "comment": "Malware payload (Vidar)", "value": "0e0ee1bd43278bbf24975cd3c65f5c88e6ab9c6fb30dd734fe9e9d161789594d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262751, "uuid": "280abea8-98d0-4123-b4c2-1775690a2be5", "comment": "Malware payload (Vidar)", "value": "e90131d924198e1f70ade38588e1a718094c742e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262751, "uuid": "6820ad9d-260c-4de8-9407-5eee2104c77f", "comment": "Malware payload (Vidar)", "value": "5c5b45c679e868cc4e4b06f9f1ab8a3c5eeb08ae89cd1ee1f7f969a793d80b3c5d3577ec17c6cc8a79a356a0b8f0706d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262751, "uuid": "63881740-f702-4533-991c-1f078f2500d4", "value": "T159A64A92F9850529C6EBF2349860E2557730BC5943313AE76FE816A98D2BBC0173EF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262751, "uuid": "8ab80b5a-bce5-4ea4-b1ae-aa5f48add24c", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262751, "uuid": "d40152da-e771-4aed-b729-b3aab594f187", "value": "49152:+kimx3jmYBsd+/5jqMgXuer8PEvNde5qWZ6LjD8C7pcFbmgOFP041g84RwkRK1x:nx3jlp5jDgUPmdwYR76Fbm/FgBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765262751, "uuid": "25fb399d-ef70-43b4-85d4-04c555313650", "value": 9932928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765262751, "uuid": "67003600-9ccf-4668-b18a-b81b39182c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262751, "uuid": "2993a524-bc79-415c-bc9d-6ca049026db2", "value": "0e0ee1bd43278bbf24975cd3c65f5c88e6ab9c6fb30dd734fe9e9d161789594d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6acfc1-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300558, "uuid": "e11fe2c8-c50d-4829-aeef-922aba6fb3c7", "comment": "Malware payload (Mirai)", "value": "c72003c6781210afadfce12be01f6852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300558, "uuid": "c5c3bbd1-b532-4248-9ba2-ed92062a69f2", "comment": "Malware payload (Mirai)", "value": "0e1ab2890eef2d63ca248b23f71f63b0bb2654799a9147843f9a7fa197fe0818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300558, "uuid": "139f870b-9617-4f1e-96c7-3e9ca107db2b", "comment": "Malware payload (Mirai)", "value": "1b23c6725c29b17c7962c69e880078ca7d69506b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300558, "uuid": "05c5ca5e-6463-4a45-a712-8a21755d827a", "comment": "Malware payload (Mirai)", "value": "b1434285b8984a0f031b971925dc6060ecff9fbc0eb144ea2bd630f5960c49dbc91fb35e466decda11e06fcd22a5be9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300558, "uuid": "04d16d98-2f5e-4556-ad17-5b3cbafb8524", "value": "T1EDD3920E2E318F7DF769C33587FB4E21A75863D622D1C685D2ACE9011E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300558, "uuid": "145ebaa0-f892-434a-94b6-6225de6f6254", "value": "3072:EQUEsP/8V3tfFzqy46jaNMSRpl/KOQF3IFaVrkJgiDZ79YIsM8kOMGloWct07ftl:EQUEsP/I9f4yVSRXExJ2fENf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300558, "uuid": "8c0cb3f4-6ad7-4a04-bf2f-0bc6b6dbdc6f", "value": 142732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300558, "uuid": "3762480f-597d-4af4-9652-b5da5045723c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300558, "uuid": "77005f14-34dd-49f8-81ff-26192de0dacf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8095651-d527-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302728, "uuid": "59fc8b05-600b-4b57-9f43-9603826f7c91", "comment": "Malware payload (Mirai)", "value": "095f6714c8aea3a1fd9d62a8d91196db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302728, "uuid": "25ffcf04-a709-402a-bb5a-4932c2366f36", "comment": "Malware payload (Mirai)", "value": "0edf449d7a71103e7df791076389022a0d7e263496731e09b321189380086109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302728, "uuid": "6ed83cb1-2676-4e96-a20c-32194a370411", "comment": "Malware payload (Mirai)", "value": "61feb4f06b30dc5db06e38281c7cb1581e281231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302728, "uuid": "9b04e43d-271f-4589-99d8-af58aee6c67e", "comment": "Malware payload (Mirai)", "value": "5aec7d646c0184624d6f8bd171597fc9ee05a30600aa988715983ff0f78bed14a29879d8e514dfd7d10d8819d4ccb2cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302728, "uuid": "5cc389b2-a233-4a0c-8f1e-54c8c97faf83", "value": "T139358C9AFE1E3C03C2D6E23E9F5A83B4532B7190D22351677A41126CD4D6EA8CFE3651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302728, "uuid": "332604bd-bb14-469a-9bc2-e77508656f04", "value": "24576:STOC4CGfhfyLIcfu6o21btRJjkfSrE19jYmtw/:SiBharzkfQE19jY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302728, "uuid": "aafa3104-1afc-437a-84ea-2c05b3a187dc", "value": 1136984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302728, "uuid": "670aa39a-a006-47e8-b787-0e1241d0dab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302728, "uuid": "a012a070-76f5-4ab3-85d1-c5f134cef9d0", "value": "mirai.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996b5342-d547-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765316394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316394, "uuid": "ea620675-bf01-4c31-90f5-b87305a76f09", "comment": "Malware payload", "value": "b8bab1c3e24dd1c831bb7f84d4e22659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316394, "uuid": "9e2665cc-0781-438c-9de1-94bc02087c86", "comment": "Malware payload", "value": "0f529e424b18e942540829a675f38b35c5bf190dcae224b8b92383d401e9824e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316394, "uuid": "d9bf0ab2-ca43-4e6c-803b-ce3c7d9e7d29", "comment": "Malware payload", "value": "0c31cb528ecf768c327471e6f9ae0a5e2cadf925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316394, "uuid": "eaf3ae08-5e38-452c-9f97-6ffdcf0b72d7", "comment": "Malware payload", "value": "688ae2a40958fa8d09aa26c5b6440cd0a0df446237c16f36b1f47f4c73c46972627b06cc81f4c8afdbe1c4f625735aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316394, "uuid": "d80e58ab-f679-4e9f-8852-bcfa61859334", "value": "T1131833740FFD2C03C4B01BB6AB7039ED4464995BEEE96E4B079AE7346181B1DDF2211A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316394, "uuid": "8dd17fdf-96a6-4a0f-a371-0646ee07a441", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316394, "uuid": "27f2085c-1627-49ef-b767-3afabc0b05b7", "value": "1572864:sBYqPsDQQqsEQr53EFC31TM+YviKOg7s5zGFe4fB5fK9uZer1Z7d/s0Hln/EzrOm:sVPsDQFBCtEFqho2gssEYB5S9uCH7d0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765316394, "uuid": "17ea3f6d-7555-41c6-957e-52278d4499ba", "value": 92192032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765316394, "uuid": "5554d97e-93ba-4d13-afb7-0c02e7365fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316394, "uuid": "78451501-418a-490a-81ca-e7de0c0f02df", "value": "Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a937a4-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765286460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286460, "uuid": "03f1950c-ba31-4294-a644-93a99305fdbb", "comment": "Malware payload (PureLogsStealer)", "value": "5a94ccdea34b19feb5ea3bed8316319c", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286460, "uuid": "69e0c82f-cff2-4884-8498-9c4ac97d7177", "comment": "Malware payload (PureLogsStealer)", "value": "0f671538deda8d42bf58df7c86fdb6c928fd5a9468f8baf054cae22637559bb5", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286460, "uuid": "8086748b-da3a-4b81-a49c-9d127c071e30", "comment": "Malware payload (PureLogsStealer)", "value": "368e1bb27929bf165577aec4d4bfb3fa6462585c", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286460, "uuid": "ebc89cb6-64d7-4756-a49b-4e85fcc593e9", "comment": "Malware payload (PureLogsStealer)", "value": "912ce58c968febdb1a97eabecab1a5bb33219fb6e2a1526826b6decbf66b5525a3d68300185f84b3c9bf0ad308f9018a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286460, "uuid": "7a4714f6-9b01-4b0b-b67a-b299c5e201c2", "value": "T1DD150A524F3FFC69855E48E56A527DC986A48342B6CBB06D892857ADC4DF4C3F3ACB00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286460, "uuid": "638ad7f3-6aa7-427e-959c-286fce4e4821", "value": "192:UN2Ab8i1uITwn3x//G6nBiYGejJ9IozFe+n0OOA6lZ6uwCL79COwOwJaF88j4BTW:Q1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286460, "uuid": "6ee66343-6f31-4974-be92-31e2d4d0643a", "value": 920360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286460, "uuid": "1c268915-3bc9-4a1f-b75f-992672292234", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286460, "uuid": "84f08101-162a-4174-9fc0-70de03de2d79", "value": "Payment Advise_178,000USD_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baeca82-d517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765295701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295701, "uuid": "76828395-6655-4423-b610-3a51d0396bd1", "comment": "Malware payload", "value": "b0fecd343d788d212e763398c6252f65", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295701, "uuid": "de424eb0-b7de-4451-8071-6503b4ce5be9", "comment": "Malware payload", "value": "10ac444998acbf7df61a27205e104023d3722b4db77bc2ca3bac37b887d9998b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295701, "uuid": "84860e94-15da-48e0-b5fc-2051c4d68a20", "comment": "Malware payload", "value": "a08b66f59deb02ed954edbf95afd991e97ea7078", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295701, "uuid": "c517a7a0-5473-4756-b0e1-397cb0f83840", "comment": "Malware payload", "value": "077e39e9e4bcbf4e50645fca95058b6d4ee96d3ded8fe3852663d2a7d7fad8d370c48ea119c6e1613d12fb087684cbd5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295701, "uuid": "cecbf2a3-3f7c-41c5-ae5b-ac170608d317", "value": "T11F165A02B944D2A4C4DAE178EB61D1927621BC9B073137F31F667A730F763D81A763A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295701, "uuid": "8e8fb155-93e2-4473-8e23-82e1448019be", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295701, "uuid": "ec8cf382-119b-4602-b57e-79775d874e7f", "value": "49152:92l14VZra+4G0yDfn1Xl+R2Yav7OPWtpmZIg+A8wE2Y:9hBC8OPWtp48wEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295701, "uuid": "9db14042-dac7-4804-9613-e00425cedb19", "value": 4077784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295701, "uuid": "309c3546-fd4c-4b4a-a2a2-71ab89a3ba5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295701, "uuid": "ab2775a1-0806-48f0-a90b-52bd459a44be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e05d09-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765286080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286080, "uuid": "f8cfb6e7-2b9d-4a17-abeb-cfd695a26b0f", "comment": "Malware payload (AgentTesla)", "value": "b36726a62a1a30cef4aae45de32fb61e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286080, "uuid": "e87e2d88-b5d8-4f32-9554-1b9f5d735ab3", "comment": "Malware payload (AgentTesla)", "value": "116056be6f10cc39aa302db3b2f1fb0b83ed63b36d790fdeb6f38b7697a82d97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286080, "uuid": "fe19d1ce-6694-4d10-9d4a-afbb106a20de", "comment": "Malware payload (AgentTesla)", "value": "2d139a9e59962ac9cdd86d1a09786ae4aabfa246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286080, "uuid": "5b67b017-fc11-43b4-a58f-f3f44116222a", "comment": "Malware payload (AgentTesla)", "value": "409452ecdea32e14ef71007880ee321adcff8f584f0ad7a05b1dcb3c9dbdb008df03e8442e782e63aaf0db02bd94665c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286080, "uuid": "a1e0863f-ed9b-4960-8a89-8f7b5fbb2af9", "value": "T160E46D30DE3402694F4B1BDAFDA50A6189BD861D463694F2F2DD030E610A5FCE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286080, "uuid": "fb1dcf41-6afa-4de7-b847-555c83f2fafd", "value": "6144:Qw13xw1QwQwm2SwFw1Aw1+w1Iw1/w1ew+w1j+w1vMw1d13:r2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286080, "uuid": "f09d96ad-a1bc-4621-b487-ac9cca185f57", "value": 719667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286080, "uuid": "d830cb7d-8ce4-4664-b1ef-b47fb0b9687b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286080, "uuid": "4f5d2569-abe9-4aad-a272-c1424bc48b8a", "value": "2025-12-09-00539.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbd3664-d511-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765293017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293017, "uuid": "10783347-b3c1-4a4e-a824-c4ddef5f48d8", "comment": "Malware payload (Socks5Systemz)", "value": "130e60b7b3f3252da63aa2c3973352ee", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293017, "uuid": "f7b60580-f78a-4629-886a-9f0a2ba4a1d5", "comment": "Malware payload (Socks5Systemz)", "value": "11c3fc0e9d2d137e21e157d13ac140d221b2a5f8077f0e4843ae2b62cc91a420", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293017, "uuid": "043cc64e-3e6b-4ad4-8c03-ea0084332ba0", "comment": "Malware payload (Socks5Systemz)", "value": "d7e42a5ddbcd67764ba28bba99f984589e07139f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293017, "uuid": "559b51af-8371-4f30-aea6-c7a1ab1bb50b", "comment": "Malware payload (Socks5Systemz)", "value": "0e42fbb1f66adf6f81658e6598df87eb62ab09cfcc859938fbd558e2867b490f9301c7583aa6bb2dc0dc957302a7f3b7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293017, "uuid": "fff77d29-936e-40ec-9e3e-3c4d87a41c50", "value": "T174F5331A7159F1B9F9630A314D0694EE426BF8123E748E1374DC6BAF93324A1EC9D7E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293017, "uuid": "cc2abe05-7426-440c-849f-7d78a2fcbdf7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293017, "uuid": "eaba5c2c-f606-41c7-8430-bfb78605eebb", "value": "98304:MFzjPOVDe4KOKHT0PnWymBVD1ZkRTS3qwbBEuw:EzDOVDMOR/WlZkR+qwCuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765293017, "uuid": "84319362-99be-4177-8734-38f6be6d7a25", "value": 3461377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765293017, "uuid": "6fa927c6-dc39-4d2b-856c-598ec87e4521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293017, "uuid": "b1cc4025-cde2-46d3-a383-9a42fcb75b34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e27304-d521-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765300181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300181, "uuid": "6fd4a205-f2cd-4ae5-ac55-0f325cea9fb8", "comment": "Malware payload (AsyncRAT)", "value": "2f693cd0e5bcfe531f84ae38eddd1b7b", "object_relation": "md5", "Tag": [ { "name": "Async RAT", "colour": "#4EF76E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300181, "uuid": "a0ca53d6-d152-4163-81ad-de4a8de8af67", "comment": "Malware payload (AsyncRAT)", "value": "1220b3c971b1a87d36b5b7fe6a4d258e2f5b3a486e71398d29ee49d50e73661e", "object_relation": "sha256", "Tag": [ { "name": "Async RAT", "colour": "#4EF76E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300181, "uuid": "97fdbd49-4f9b-423b-8084-10b1125a3208", "comment": "Malware payload (AsyncRAT)", "value": "5b14ed256bf7055b222e566d542c8d3b4e7b0aa0", "object_relation": "sha1", "Tag": [ { "name": "Async RAT", "colour": "#4EF76E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300181, "uuid": "a75f2a21-a2f4-4315-b35e-fb8df87bf39e", "comment": "Malware payload (AsyncRAT)", "value": "a58216d4196c56511b89a037c69173d0e24db95f78fdd5418aa112193e700d89f42b57846b371fb117ee5592248e1dc5", "object_relation": "sha3-384", "Tag": [ { "name": "Async RAT", "colour": "#4EF76E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300181, "uuid": "edc133d7-7ed7-4bf9-8338-393af05c1a06", "value": "T10E231B003BE8812BF6BE4F7899F26145467AF1A32603D64D1CC452DB5713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300181, "uuid": "c46d9777-ba57-4ff6-837a-48c27384f942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300181, "uuid": "bc6ee675-e9ee-4605-aca6-944c62454fa4", "value": "768:Juy04NTdMCbRWUJDObmo2qLRKjPGaG6PIyzjbFgX3i/s+L0pPvIZNhtBDZbx:Juy04NTdxe24KTkDy3bCXS0iW2Djdbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300181, "uuid": "6ae787cf-f131-4212-a696-926bed14f815", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300181, "uuid": "5fdcdb94-60c1-40f5-8308-0350a961b37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300181, "uuid": "ac24e601-b96d-49ca-92fd-0cbc54ae8959", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10809182-d502-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286529, "uuid": "2be4beca-5333-40c3-ad8f-bf392598d6f0", "comment": "Malware payload", "value": "0bc1c6a36e86a20027243a01907e5cd9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286529, "uuid": "03df12af-a7d9-40dc-8360-8fa27b267a76", "comment": "Malware payload", "value": "127dd7c91cf8240ffc01524d4c3b94d982737680cd28904d46addd3ffbc63b92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286529, "uuid": "1b794de9-ec89-4e27-9ab7-4e0eb9c2bfa8", "comment": "Malware payload", "value": "f1b536951f3b430975e2043ad5ea8cf9feccf72e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286529, "uuid": "25451742-3cdc-4a93-91bf-fe01c9d80eee", "comment": "Malware payload", "value": "4dd20f39d6522a5421eb80902c2b5d2a94ac1c908d78a9109581a651ff37ffae8772e0bbc18b898c777a6a0837b884e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286529, "uuid": "6a219639-71c6-4271-bb81-7e30255ee27d", "value": "T1A3161277473D5580A4F254AD2C078B236B08519AF2AC44FC31A6C5A8DE8A07D9C7EDFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286529, "uuid": "89621127-66d4-4e14-b780-c673539db318", "value": "24:tKfehmuAIuILoXqzH/1qy6wcBYSiQcwXwe:UemIuITdczge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286529, "uuid": "fbea0ec1-56ed-4216-babb-a1fecb6ac9dd", "value": 4033813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286529, "uuid": "23151e52-b5d9-402e-884c-b991478cb9bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286529, "uuid": "4bd7d518-8d27-4bc2-8f89-37a0ce0e45bd", "value": "0bc1c6a36e86a20027243a01907e5cd9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482dd8de-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287911, "uuid": "d23d343f-25fc-42ce-9617-d9187fe5164a", "comment": "Malware payload (Mirai)", "value": "6eaff81c274e724333b62aeb5557dadf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287911, "uuid": "d66206de-5f55-4103-a74c-176312453206", "comment": "Malware payload (Mirai)", "value": "129d77d7530698dc8c0bae62f40e1f34fce448e758a70d9260d90a19b01482fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287911, "uuid": "477ef943-c10c-4aa4-afd9-be3a57349a4e", "comment": "Malware payload (Mirai)", "value": "236ecd128b72959e640dd5361a407bf80bada18e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287911, "uuid": "5bd47fa0-94a5-4987-9361-cbc164640ac7", "comment": "Malware payload (Mirai)", "value": "a01e679330252127798d1a05d91581f0899384a4b523c04abc217c990716499e69a4097ca0f43dff6eab05e4655d8acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287911, "uuid": "6d4f1b6e-d1b4-4fb6-bd93-922474c56686", "value": "T1AC634C21A67E1F1BC5E0F17AA1F74766B2F5074E14A48B1E3E610E8DAF64570330B6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287911, "uuid": "df02b39c-60e5-4c06-a328-5b2d78d9ac77", "value": "1536:cjPU8JoUwvqy2pZ08+JE+w402W+LpkJ86CYtl8RdP:WvJdLSFTLwCYOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287911, "uuid": "39a2177e-a58e-40d1-b517-d77d8dec4e78", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287911, "uuid": "af7eb2d2-accf-4d44-844f-b5da0769301a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287911, "uuid": "dc8838b5-61f9-4f9b-b882-cbf839ecfc89", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378435a1-d54a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765317518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317518, "uuid": "6f485519-92e8-4daa-90eb-1fd4fcaab373", "comment": "Malware payload", "value": "9c3a6425cb59cf3d873f46c13bfa46a2", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317518, "uuid": "33e9e299-d98e-4a9b-bff0-e63aea148c8c", "comment": "Malware payload", "value": "136bbbbd01930a949f851e7e66b96f93c028313d903c91b9d27bc837d17011cf", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317518, "uuid": "089c26ef-d3ba-4a07-9497-ab2cb0f987d4", "comment": "Malware payload", "value": "6a32bdfa961e97dc8bf35f1672441ba6e41dea47", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317518, "uuid": "485e3758-1fb0-416d-b44e-13f7f8fa228b", "comment": "Malware payload", "value": "fa700e4ecc81cd5a26a1f8d563d8995b14693413601289ded62fc78fcb242cfc013e21d29453f3acd68568c8840dbcb5", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317518, "uuid": "fbb45939-0d75-4d97-a4d8-c411a3f93f1a", "value": "T1CED4D14D65258C4C0130E5BB669A6BFF39A5FACE60F00CFB5B83F6513C340D26A15AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317518, "uuid": "a9c96124-5e3d-4d05-b595-e057b23cf3ac", "value": "12288:f0WS42QDYJNPr894f3ZwIeWOaOOFrigaxin:8U2QDYJNPrhqWq2Rsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765317518, "uuid": "aae522bb-9d83-48a1-b8be-b021c1c6c0ab", "value": 625031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765317518, "uuid": "b9119b3f-83ad-4fab-ab97-33b7b1263662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317518, "uuid": "5aa3710b-5280-4809-85b2-16f2c8fe9fe5", "value": "39d7c4c4967b0a25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f107f3-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765286855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286855, "uuid": "0aedfec9-23b7-454d-86f8-e40f12a753fd", "comment": "Malware payload (PureLogsStealer)", "value": "8ffd31a1788c2aca0c5581114e3e1733", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286855, "uuid": "8b5fd3db-732f-4d39-86cb-752f1d626654", "comment": "Malware payload (PureLogsStealer)", "value": "13cfe3fd5a544dbed0b3293db0303a4ecbd81eecad53b511f28dfbbf25f156cf", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286855, "uuid": "de104dc5-e4a9-4474-ad11-89b65cdc18ea", "comment": "Malware payload (PureLogsStealer)", "value": "a621059f244ab1db21def11852625ac549c205fa", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286855, "uuid": "f5052a24-2cef-4160-a1ed-34b8d8332760", "comment": "Malware payload (PureLogsStealer)", "value": "03307a605a28ecfc3816382781c18d5bb1dfcbafee17a96475aebd8fd272650934b825af2644ef9bcd4ee596b3e1241a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286855, "uuid": "35c0ec23-b2f8-45f1-92ed-b9d992474ba7", "value": "T1A985127DB1F4D4EBAD32B3B0C11B670E45A8F907538DC849681799D38F20E256E2D92B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286855, "uuid": "4ff0c816-939d-4b3f-bd25-f7d4db136931", "value": "192:6BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBW:S5moC4E+lBKCBueV8QKYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286855, "uuid": "90e9e15d-09d9-4152-bf7d-c1807d5f7e5e", "value": 1828638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286855, "uuid": "50f95083-1a99-48ca-ad6b-329977505bc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286855, "uuid": "aabd6e2f-dc73-4f98-8cda-73ec7d08a431", "value": "pagamento.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83b1465-d4f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765282515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282515, "uuid": "68973d0e-e0a3-4c1d-8b6f-7d9264d7940d", "comment": "Malware payload (Mirai)", "value": "e3cd5dfb83627f46a9b6a0206dff5ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282515, "uuid": "2fd0e5f3-1660-413f-bcbe-71fc57a1a92e", "comment": "Malware payload (Mirai)", "value": "158ade9b9ab54d81217ec78607517ea0d7b1ac66a0d6ea85f924ee7a69edf1aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282515, "uuid": "48a6d569-190d-4b13-9697-01c34c4e7ee0", "comment": "Malware payload (Mirai)", "value": "fa5e425db588e8cf5ca2e558be60ee1bec4027be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282515, "uuid": "9f97e002-c5b3-4df6-a132-7ca65a7ea1b0", "comment": "Malware payload (Mirai)", "value": "4ae0698e86a9bea46101439110b0481f2597ed937538da48c0d66040a3167b32cbf044d9baee46c5bd72dd1cdf932986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282515, "uuid": "07eae002-8319-423b-81f6-cf8e178f4e93", "value": "T1FC633A92BC819A02CAD412B6FE5F519E331623D9D2EA7207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282515, "uuid": "f130e619-49be-4f1c-91af-484d300238f2", "value": "1536:/WloK05nJ7xkC0ztNrB28k+EWwq04uVW84lx1RVvH:/WNY7635qOEfXlVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765282515, "uuid": "dec0add5-a964-43ca-b379-a9663a685a6e", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765282515, "uuid": "886f50bb-46b1-4f66-9cb7-a8220fcee828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282515, "uuid": "6a9379e9-d687-4672-88f0-f93b93f98d26", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c050af21-d520-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299709, "uuid": "c4ff91e6-a8f2-44d0-8357-bfb53d0319f1", "comment": "Malware payload", "value": "d415edc41431f8d2fcfb463fe2d117e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299709, "uuid": "72816b05-8865-4092-afb3-b916538075fa", "comment": "Malware payload", "value": "162aab4bfa96b1b69cc61a3bf0a6fdfcd8774a5a455c96ba2c21c07fbe43b6bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299709, "uuid": "0c8a007d-a54a-45ff-ada5-ea606675acfa", "comment": "Malware payload", "value": "49bfcd6b34eb4bfdc0aafe524a9c1adcd6416d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299709, "uuid": "329faaf5-1fb7-4fcb-8e33-d0eaa4428181", "comment": "Malware payload", "value": "e68a651c7e4bf39389e089730959fe0658f2e9d67950f7813bf93db925b0f12d9592cdcbdb1e3395eee9322bc65194df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299709, "uuid": "c53b8227-74e8-4aad-9178-eeae24cddf23", "value": "T1CB530985B8919A13C5E462BAFA5E41CD332613F8D2DF3207DD11AF257B8682F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299709, "uuid": "fd98c5ce-d34e-4912-9c44-4f4ffce7f1bb", "value": "1536:Sr3i6RSCF8Cn30I6DqO0RqAp8Kyc3pH34nSXT3bsR:Sr3i6YD2RqAizARoSXT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299709, "uuid": "6ba08859-73fb-495d-88d3-c52a7a69a8db", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299709, "uuid": "e627c740-cd92-4ede-8306-417e18e3e7ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299709, "uuid": "59dee907-12af-4dbf-a054-500e98cc897f", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89472d7a-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307777, "uuid": "92d078dc-772d-43ae-abb1-f3942d3765ab", "comment": "Malware payload (Mirai)", "value": "5558bdab65aa26f3f3a12c9baa41cac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307777, "uuid": "4521e20d-33b1-47ca-b933-a3e2b4f1ab4e", "comment": "Malware payload (Mirai)", "value": "162de8ff7f139d1b1de7eb2f4828a4db3c748708c002e79b4c7643453e5a8744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307777, "uuid": "6eb545aa-81a7-4be3-906e-0643ab58c388", "comment": "Malware payload (Mirai)", "value": "dfd87b8b192d247e6b060630509be7ddbaa3a4a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307777, "uuid": "9ff42ed5-df1a-4136-84ad-b7d9d353a0f6", "comment": "Malware payload (Mirai)", "value": "6148910fd5820e88baaee180e0e1d032d74700142312605af42f44cda61fee1e274b51ea44a6d0990333fd49992dd88f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307777, "uuid": "84122163-58a8-4f8a-8e39-1807c707f7e9", "value": "T16164C61E6E228F3EF7B9873443B74E20979933C627E1D584E1ACD5111E2065E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307777, "uuid": "29ab6f98-864e-4b34-94f2-6d53fe77b009", "value": "6144:pW7S4BCbfdK9behJnEpSLAFlYSZOPUt/hjZAzC3GWjb/yPLeKi:cYdkXlYSzjZgC2WUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307777, "uuid": "e05633d3-f330-4075-be39-838554eb80e9", "value": 328684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307777, "uuid": "06f549f4-6716-4b19-89d0-8404abdb00a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307777, "uuid": "793406c0-8161-4a6b-b798-2e2b9e77703d", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b6052b-d520-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299583, "uuid": "c5564877-4064-4e5f-8125-83d3c59933f8", "comment": "Malware payload", "value": "4a23aea854dab603787d71fc6bf3c758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299583, "uuid": "86704411-3da2-492f-9172-4026ed2654c0", "comment": "Malware payload", "value": "16a51f5f8dab32ddd23139c9a358635cf50b6b50bbff950552e9d583052071c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299583, "uuid": "585ef21d-29c6-4f92-91cc-9f84ca50727c", "comment": "Malware payload", "value": "da2959c2a8cc894f8d5ebfa5df7800765e4476ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299583, "uuid": "9566c79b-798d-42f4-a14d-ced12652ecc6", "comment": "Malware payload", "value": "7c3f209e4d46a64d6987d17208ed9a6f090f5d7d965c9a771a97a714fc24dc1a69df6e2bdd728372d0c0312008b176fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299583, "uuid": "99a3a02e-3eb7-4d3b-8426-4c67bcf3fbc3", "value": "T110C4B552E654F82AF49B4834ED2865FA29292C35E904EC4FF7807F9A343098B75F461F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299583, "uuid": "166c739d-5899-45a4-aa69-e107148495ca", "value": "3764a14dcb677811031acacdbed6d24e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299583, "uuid": "e4ab218f-17fc-4381-b5a9-c5c4a9b5a683", "value": "12288:UjhyCj8/5nC8fwpW8EXuRqnl7YegL21GI:OyR5HwpW8wl7YegL21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299583, "uuid": "a543b421-ac7d-451d-812b-66bee5a62015", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299583, "uuid": "57a14a48-7119-4b35-a284-0907b3762523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299583, "uuid": "4a6a95e5-8fb5-4384-85de-3c749d1e3b26", "value": "COMMOSA_COTIZACION.DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926350e5-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264413, "uuid": "c394fe24-12f6-4266-ace7-4cd324a4fbaa", "comment": "Malware payload (Mirai)", "value": "6fed2a54f6adeeee528f3ea82acd4e8a", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264413, "uuid": "8732ab02-2c34-4732-a665-e3f3f3c8f91f", "comment": "Malware payload (Mirai)", "value": "16bb8697cf890c28605991e9f6b674ef98700eab21af9e1f309c65289ffcfa02", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264413, "uuid": "c8a67ac8-561e-47fd-b401-b2e6a1558cd5", "comment": "Malware payload (Mirai)", "value": "0f7bd90c6bfa797ffc5a1fe88140a6ac06f42259", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264413, "uuid": "17357ceb-05ab-47e3-93d5-949042be3b42", "comment": "Malware payload (Mirai)", "value": "ee4b06ea33321379b14025cd31f67e974e8e54b52d3dbde397a3ac63eb07c7354a6c1ab589771d5be38e70aa562405d8", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264413, "uuid": "b9b2c427-6629-4b9e-a53e-94b47f3f1342", "value": "T113E47D9BFE6E3C47D2D7E33D9B8A83B0532B7190D71351627A42032CE5C6A9C8FA1651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264413, "uuid": "9583a2a1-4146-44e9-b7ce-f72963b793d5", "value": "12288:xsuRBnxatyukR4zBC3eIWlEAN9s5t3B/3ysa+/sWt2a:xzB5u9BC3eIXAAlO+EWt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264413, "uuid": "dc8cf397-5fde-496c-85f3-a1f1bfda89b7", "value": 718040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264413, "uuid": "16ca6395-e5e2-43e3-97e7-0a22b212132c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264413, "uuid": "1612271f-9022-4fd1-ab39-31028d02f8f5", "value": "mirai.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e58c640-d535-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765308537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308537, "uuid": "63a7f0c3-5fff-410a-9478-271b5f927518", "comment": "Malware payload (Mirai)", "value": "c15420ea6450bd6899b733cb07dfc951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308537, "uuid": "c2a40cdb-9bb4-4728-a74a-fae5ae80dae1", "comment": "Malware payload (Mirai)", "value": "170170dca04f16c7c618669c2f0208ca52207a1afd21609bcb5af3e759319bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308537, "uuid": "f37d58cb-b5f0-4a91-945d-c22823a9f8e3", "comment": "Malware payload (Mirai)", "value": "c05f4838dff75ef8b78058b937a89346e562f64c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308537, "uuid": "91f2b034-5970-4e2c-9d8f-8bd953541992", "comment": "Malware payload (Mirai)", "value": "2adae4e951f820456915c8f89a55a4ec5c022e3c0df5d0eb86bf319493f71d279711e828095ed69d746669d2dc0676f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308537, "uuid": "4f5d6d8c-ca90-48ed-aeae-1a51bccc80aa", "value": "T117830252D57874F5EB2D6C6FA8399DBE1D2B9F30C758B8039FE0C09C4A618988B94119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308537, "uuid": "fe121179-a8fe-4a06-8e59-413ff4cd3d4b", "value": "1536:/tBPaaIEz62hDKUhJ9WFiSOSl61xMebPeF2dCd8UvVgaVpLf:TPJB+2VLrWFiSGcgGF58SVpLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308537, "uuid": "bdff4c54-32c1-499d-b413-83a867103f9e", "value": 87240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308537, "uuid": "dc707872-2638-422e-b8ae-3d8000bb1b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308537, "uuid": "e7da5975-3507-4abe-b4e0-7b6f885a4513", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a773b1-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765278894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278894, "uuid": "14bd658c-216a-42ca-8af2-f77691f7b256", "comment": "Malware payload (VShell)", "value": "a5722451191c09ea89d81b2e92eea2b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278894, "uuid": "73acdb64-3bbb-4e96-87ee-c11a97c8a84c", "comment": "Malware payload (VShell)", "value": "17271fce020d63450a5d4dd17dd3186c53fa22704e6973ef7d51da5505a0f468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278894, "uuid": "78a8b835-284d-4096-ac06-e4c229269444", "comment": "Malware payload (VShell)", "value": "493835a78007aac70a18608c8b722c9e307ffab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278894, "uuid": "520ee06e-0403-463c-985b-70ac0cd11e0b", "comment": "Malware payload (VShell)", "value": "a025611ced84f93c48a2b49699b27ba9bdcaed337b33aef255ae9701a40b7ee854d0e6f1ddbcb131f1399524b572791b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278894, "uuid": "0a4efb8c-7d62-41d7-907f-d6380f72bb95", "value": "T1E7862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278894, "uuid": "1ce0ea76-8395-41b9-910b-36e6ee4a76aa", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPX4:glRJXp8L/KyZcCb7HEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278894, "uuid": "f9b92560-453a-401e-9c81-13c0532931eb", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278894, "uuid": "520c019e-4fe1-4ca5-bfa2-a9ef4fe31ca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278894, "uuid": "3b49b3aa-fbe8-4ca8-925d-7783be283a1a", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531a8639-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287929, "uuid": "b1e500f9-0ef0-4ac2-bfe0-fded4fa288d0", "comment": "Malware payload (Mirai)", "value": "6cca4d551398e06b9c50a84937e2ecc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287929, "uuid": "85f3eec6-c8ed-47a4-b162-ecf263271696", "comment": "Malware payload (Mirai)", "value": "175082dbabc42fefa575c284931ea8e31979b010bcc6e29f593150ed66700cc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287929, "uuid": "d85c074d-e07f-449b-bd34-905763e70d9e", "comment": "Malware payload (Mirai)", "value": "315cf272aed3032b888fa2238d53eab9cb280308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287929, "uuid": "77d786ee-a447-4eb9-8165-011256b0810a", "comment": "Malware payload (Mirai)", "value": "6c00b2e45400d59df922ef2d73b728ac6519f2bf2f94d1ab7fb9c79978db9f303d0b65a36282e7f46987bcc7f7c267a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287929, "uuid": "a55516ee-4d2c-4938-9222-b9ab6fd291d8", "value": "T149633A0272280957D8531EF0393F1BE1E3FEED6111E0B6492A0FBB4542B5E72198AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287929, "uuid": "ed88bd8c-9745-460a-bf66-a9a15d216d36", "value": "1536:Z3Hk6ZI8DXrn8kM5IBBc6/ciwOv5J6B4r8M:ZXk6ZVrnkiBBuJarB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287929, "uuid": "4a6926b9-3218-4a70-884b-adaa392a92d6", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287929, "uuid": "89f3edaf-47ed-4519-8455-e9144748cf0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287929, "uuid": "f4320f9b-cf1b-4e3d-8766-88d210aca146", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea95998-d4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765267225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267225, "uuid": "3ccaeb12-43b4-443e-b89b-9575b0af20d4", "comment": "Malware payload (Socks5Systemz)", "value": "aa19c807664bea0a4bc40525e62f9d41", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267225, "uuid": "d5921c4a-297d-4fbf-9301-36957f83191b", "comment": "Malware payload (Socks5Systemz)", "value": "1998418550c262308db08cf25b37bdba87492f4bf220471044da3b065792caff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267225, "uuid": "8e8dbd92-2342-4bd5-bb07-48302d34c56b", "comment": "Malware payload (Socks5Systemz)", "value": "eb2f61751ce393863917bfc7b230fb78192af987", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267225, "uuid": "3742ddc9-a6bc-45b3-8c6f-0ea12610f334", "comment": "Malware payload (Socks5Systemz)", "value": "cac4e9afbc1fe545cc9055d537ca826f9193d361e4b5fb62cb8ed75c35fce1bbb0e155c58bb7b1e42c16bee4600bae5f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267225, "uuid": "639c7284-4083-4bf3-8e16-e06e88c7c424", "value": "T1BAF533A632F9A4F6D0D6E8BE452E2C313573F4E55EB0127A22EC594F77962C4D802B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267225, "uuid": "24bfbdcc-0421-4fb5-b943-f08ef5c7f8c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267225, "uuid": "eea8abe5-d63b-4f06-927d-7bb8d4831f8a", "value": "98304:MPLsvkYuexKReRk3djwBuBIZPLxtdrnJ9I9W:76esY4IZPL5r8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765267225, "uuid": "1cc992bc-74c3-4c4e-b6a4-eadf86bfedb8", "value": 3583006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765267225, "uuid": "a9b8489f-9be2-4fd9-9fe3-88de650506b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267225, "uuid": "182c6637-4af8-414c-891a-331d09c62491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92822355-d4f2-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765279875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279875, "uuid": "cab0a249-b792-4c4b-86b9-1d753522032c", "comment": "Malware payload (SnakeKeylogger)", "value": "0384f960849a6dcd1d910455063ab2ff", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279875, "uuid": "f7eeea5b-8b8b-475b-bc8e-d42342ff18ec", "comment": "Malware payload (SnakeKeylogger)", "value": "1b2c9a1420b7b7bbb1bac72fdb6fccebc45351d263bd20ab2c93099d478c0db0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279875, "uuid": "aa2e7691-a1d0-4201-8f9e-0c9941458513", "comment": "Malware payload (SnakeKeylogger)", "value": "b87e3254b3d898686186c9e610f4cc9eb9287a9a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279875, "uuid": "e37921bd-42c9-48b5-9e89-bc6d718eb891", "comment": "Malware payload (SnakeKeylogger)", "value": "548ecafacddb09c50a2ce06f71e0a114eff8bf51f450031cd3a30ba6fc94b2b541daef0f4121e70a438ebc57c48a3151", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279875, "uuid": "c2e310b4-c4eb-4b79-9367-ba2de10f4600", "value": "T1F7955B5D5461ADD3A014FEB0F540AFD78CDB5384162B8A121FD5A5AA2312883FFAB3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279875, "uuid": "4aad56b3-db7a-4b0a-aa61-9cb0a718dc29", "value": "24576:lo4cZUt7qHw/iJKvuXWOW4fvpSrWFK0faPC:mfAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279875, "uuid": "5fa0e099-ae54-45fa-9b2b-a6c51b2da0b1", "value": 1917904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279875, "uuid": "acf4faf4-a2f8-45e3-9391-39ea8737a2fb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279875, "uuid": "8eca6fe8-99d0-4c5c-a85b-870b40eff769", "value": "NEW BANK DETAILS.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6cd8f1-d523-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300913, "uuid": "baeb4f6b-0d22-43ff-b33a-df4adf5e3660", "comment": "Malware payload (Mirai)", "value": "8d8c4dd6bc518b9d26ebb9bc7188171f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300913, "uuid": "8058c278-5c8c-4a8c-8218-7c4b5b574ad4", "comment": "Malware payload (Mirai)", "value": "1c560556ce08e415c3d5e707ad8ddaf9388d3ba01b8b468cbdc99fa4a72db376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300913, "uuid": "da6d26e1-cd09-43b6-b20d-7c55504e0acf", "comment": "Malware payload (Mirai)", "value": "b59938c706ae62f130ff977d7239d25364ac0481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300913, "uuid": "d90bb6ea-d3b1-4d21-a131-69722d47c29e", "comment": "Malware payload (Mirai)", "value": "9a3af9e2da18e43937a85d68f59dc464c06f8888f5e18fc5fc9273d78737f94c1f98b76e0619fb11bf6080722882f4f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300913, "uuid": "b4375748-db71-4ea3-afb9-4e80805395bf", "value": "T16A233A43721C0A57D4A21A70253F27E0D3FEAEA021E0F689A50F6F9A8575E371486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300913, "uuid": "f052f312-fde9-4191-ad59-f530f9e84fdb", "value": "768:3Y+EV1FExy3JREauhtNcBY+KNeirbDWnwCktSGma3hThTK:IrF2yZ5BBirXWOtSG5xtTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300913, "uuid": "65087305-506e-41b9-80bb-7129e25b2744", "value": 47920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300913, "uuid": "273547b3-a013-451b-bdc8-0cc17f695138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300913, "uuid": "042406f9-458b-4dae-a874-f9deeb9d3d31", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8103a30-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298057, "uuid": "5dd04a5e-d015-4510-b555-1fa450409717", "comment": "Malware payload (Mirai)", "value": "c93ad57557264d022b89015b72cde24a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298057, "uuid": "97c47d3e-2bb9-4d28-b86b-9fd304f8ce09", "comment": "Malware payload (Mirai)", "value": "1e31c5588a1085d79c6b656da8e6797778f7bb5c739daa9a9dcaa8df4121f725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298057, "uuid": "88dee6d6-b03c-4f42-8a74-d578a7739dff", "comment": "Malware payload (Mirai)", "value": "c6cfbdc29a421eaf8949397b0d34709eafa6feef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298057, "uuid": "dc31dff1-401a-49ab-944d-1bd1f8ddcac5", "comment": "Malware payload (Mirai)", "value": "17b00c93aef9da098fbb53c9b43639194313e3b17fb5f877aa89fde5019a33f0426f72bd06e81bf1ebbfae41e34e9a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298057, "uuid": "b7fef069-8362-40f9-bba6-16f49495afda", "value": "T17A332980B8919A13C5E4227EFA6F418D332663B8E2EF7217DD225F15778982F0D77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298057, "uuid": "e3bc88bd-40b4-4857-bcd5-167b16b1d0b8", "value": "768:DlV78+oWn3K6uSNDzR9hpmkUAqtNKk43EWCMF3YMukpNFrnX/moET:37po8zRfpJJqtNDQ9DFuTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298057, "uuid": "2f9486a6-76ec-4ba6-8001-e451137cac9c", "value": 50648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298057, "uuid": "237d86ff-197a-4f2c-a65a-57ffa6279505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298057, "uuid": "4b40961e-de2f-4c71-b26c-fdc208e901d5", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f451591-d493-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765238987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238987, "uuid": "e7bcac46-8ecb-410f-9a68-671139e90333", "comment": "Malware payload (ValleyRAT)", "value": "3c9e2ad72495e1c989f6eeca42d4df3a", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238987, "uuid": "31a8166b-f3ad-4d72-a1c8-aa7853953f1d", "comment": "Malware payload (ValleyRAT)", "value": "1f0255a9adc1cbb3823f5a8e5ebf254c47333c01185ddbc5a54b69d31aed7d16", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238987, "uuid": "bb1aef05-0578-4ce7-99fd-cdcfde729cf9", "comment": "Malware payload (ValleyRAT)", "value": "24487cd26bfcf131d3987b841bb0412bd642618a", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238987, "uuid": "505996f9-39e9-4b2b-b966-32b7d70b4ebd", "comment": "Malware payload (ValleyRAT)", "value": "57afb3ff780087e39ce1f099fd73845c43994e5e633bcb945cec1b65b3a8f2e58ba5eeee74030b8466d0554ad642d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238987, "uuid": "6ab3e282-43e9-4df3-918a-56a4dd1725bd", "value": "T1A79423DDD80590D3674EA4B715E689A20E53631BFC0D33E3EE226B86AEC1315844EDF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238987, "uuid": "846471af-4d53-4dd0-98dc-6b8d76509e70", "value": "6144:AxwGE1WoIMwJ9lo3apcwUPZXmm1voLVm/yv34w4Lvavbutb+ciara22acO:Sx0zIMwJ9cvoGw4LkerarC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765238987, "uuid": "1e26db9d-3afd-457e-93ed-9448569a981a", "value": 423656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765238987, "uuid": "60f21e67-6139-49fe-b866-d454a0c2dd2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238987, "uuid": "943d88cf-b2c6-46fe-b424-a67e8cc94695", "value": "CBTD[1].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2707526-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765286451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286451, "uuid": "e76ca084-222e-4378-8f3b-0488735fcfcb", "comment": "Malware payload (RemcosRAT)", "value": "4ee912d2ac869667466d65999ae2bffd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286451, "uuid": "d98ccb2b-5f09-48a7-8df1-0dcc35e7f52a", "comment": "Malware payload (RemcosRAT)", "value": "1f0741dc916d87a9e2aa50aa09426e18d7dd239ca2483bd286939a3e5aaac260", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286451, "uuid": "fd70dc9d-23ac-40ea-80b4-1202676a8bbc", "comment": "Malware payload (RemcosRAT)", "value": "56328620891f8871bea4a34b4435200dcdce926d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286451, "uuid": "3097099d-6c0d-4ff1-8a51-916e285c1fa0", "comment": "Malware payload (RemcosRAT)", "value": "f1d7da8f322f4cdf4d39e02f4a4238d4d3e5e04b2e4c9cc5910ba7f418c53111ca1c7986f057bef92a3a3e51ca8f2031", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286451, "uuid": "73ecbc97-bfa7-43ff-b8e3-5fbcc7274271", "value": "T11876E877268B68D639EBED5E2630DA205C573B33344EC418F1F8622620E1D55E932DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286451, "uuid": "56a9cfa9-a366-42cd-9ca3-a494f4e8b27b", "value": "24576:7uni8PxdIMGw8SxHsQAubik2sLjPNxSd8DhemUlyTT6bBW1KvbMrc4QLjaY4NGIY:tWzU6JoLC2Mi9uqexFVJG82v6vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286451, "uuid": "1d1fab3f-acda-427d-87fe-b8553a624533", "value": 7520195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286451, "uuid": "66cf1939-2d94-43c1-9bc8-6e3b7de1f852", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286451, "uuid": "cbce2ce2-85f1-437e-ac16-dadf720743c5", "value": "dzjopzpa.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a0ccde-d515-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765294936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294936, "uuid": "54ec4093-ec80-4746-9457-cc0bd6ade393", "comment": "Malware payload", "value": "d70c272f7b5878d82c6f5cf328046b7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294936, "uuid": "ba6c70e4-a493-4856-8d4e-51bcdb27cc8e", "comment": "Malware payload", "value": "1fc74d3de12213562ead46a8518fbcbf7b95e37ac583850434a63eb46ceaef7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294936, "uuid": "5dfd2249-647c-4c4d-a3b7-0107c10fdc75", "comment": "Malware payload", "value": "18a2ef4bc60de3e9415d8ee84bf8a338e9a2ab31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294936, "uuid": "954e5189-b360-424f-a3af-f109d28c5b41", "comment": "Malware payload", "value": "e973607b0765c8a9b9bff5f82d853c873cd6c0bfd1440532a6bcacb00ec7108f7203c30cf3fb70f82ce212638c118209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294936, "uuid": "4487d1fe-15a7-4499-871c-cb0f6cff0073", "value": "T14B4319C4A603DCF9DC092E7914B6F7325B31F5750529FA87DBD5FA32B842601A90E2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294936, "uuid": "200ecdc9-edc8-4cdd-9313-eff79e64b8d3", "value": "1536:3SzNof7pB0mOn5Z3pahiKrz5OPyAeE2tCe/LnkmimQR:3SRq7pB9O/pahiRPyAeE2B/7zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294936, "uuid": "600c2aaf-d16a-4726-9d14-daa9255cb302", "value": 60276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294936, "uuid": "8fa07fac-2aab-4aa8-bea3-ab98421a83d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294936, "uuid": "9f85b7e4-8238-44fe-8948-5d2f777a3cbe", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aceb4c4-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1765264400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264400, "uuid": "86b2136e-ba24-4b3f-88ca-cb21cb215fe2", "comment": "Malware payload (GoToResolve)", "value": "01e75b4b5639e10796758963df11182c", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264400, "uuid": "ba596b48-3c42-4348-8354-79c654e9ed84", "comment": "Malware payload (GoToResolve)", "value": "1fd211ff9a039d3fba92c4a9a0564b3157c2a3963aa76253d00e6d554fa70c8e", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264400, "uuid": "17a0f447-41d3-47f3-8b1c-6f758217cea9", "comment": "Malware payload (GoToResolve)", "value": "f826abb0f702c1ad8a4d07d5c82521c4571d8f48", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264400, "uuid": "65f9b211-9765-4bf2-bd1b-f31476a723ca", "comment": "Malware payload (GoToResolve)", "value": "3ffb49a00cd34c1d1c722cfd2dc4678be885cc3f858f0d248a1e534526b20da1a2b9bfb379416176124bd41342720fc1", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264400, "uuid": "58d76599-2600-4450-9459-7369a7b0f1fb", "value": "T1E337333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264400, "uuid": "45f843ab-a9a7-416e-990b-762317cca779", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264400, "uuid": "4c9f09c9-7269-4f59-947a-3c3ae27186b5", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264400, "uuid": "bb12f0e2-f10b-49f0-b992-b5cf7451ec1e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264400, "uuid": "5c22d283-2c43-45f5-94b2-3f11a9b46b79", "value": "LogMeInResolve_Unattended PROJECT 1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b3c4b7-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287913, "uuid": "13cb8ffe-aa05-4c12-9573-77d526673bd5", "comment": "Malware payload (Mirai)", "value": "9114555010b29bd9425fa20534302421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287913, "uuid": "cb9f87ea-9a1d-4dbc-bdcb-9199ffc2172d", "comment": "Malware payload (Mirai)", "value": "2006ff61335d92f84feddd776eb0063121faaad118b9c5ac2fbd869162542b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287913, "uuid": "bc425a9a-6638-48c7-8610-38fa0465c8b4", "comment": "Malware payload (Mirai)", "value": "0db07ed28ceebea11e20379705b208d1bc73410b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287913, "uuid": "14737ae0-f506-4c67-9a4f-2746000da941", "comment": "Malware payload (Mirai)", "value": "22aaa1356f4b3e837b0c7b3e2c185538016ef7063c0c94f93804945767e111358b7af412dda43d0dadcbe56d67ae1100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287913, "uuid": "50aaf930-9c8b-4d8a-9364-5c12940128ff", "value": "T12383B84D6E219FACFBDA823487F34A35965833A627E2C585D25CD9001E7070F741FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287913, "uuid": "f3bbd465-1a0b-49a8-b0b3-f4006e22d07f", "value": "1536:zfelw6fQqlz0WXhlhwTrRwEwcm2F2T8fzTs0o/e2Nconz:zmKoQqph1wzpF2T8nO/Dnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287913, "uuid": "cdcfe1fc-33c7-42ff-a162-0526dc78716b", "value": 84440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287913, "uuid": "7a88d7ba-e942-487e-99ad-2075d03ff782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287913, "uuid": "16db1d79-7b02-4aec-bc22-681688165827", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a67205-d507-11f0-a129-42010a9c0007", "comment": "Malware payload (ToxicEye)", "timestamp": 1765289025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289025, "uuid": "ca32ae54-387d-4601-bce9-f6ba19ad0f38", "comment": "Malware payload (ToxicEye)", "value": "b91bb8b365275c793b2b93c7db7becc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289025, "uuid": "0ea8f159-759f-41a0-bcce-b170f97c1c88", "comment": "Malware payload (ToxicEye)", "value": "2055f81d63d607180b084985a2b432db93df456c810ea911764517f6d4d91fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289025, "uuid": "c9b03ca2-0480-484b-a7ea-9083d8c2af98", "comment": "Malware payload (ToxicEye)", "value": "df7c26088e76944b4b3783a5f624d43fb27fee2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289025, "uuid": "9890960b-5fe8-425c-a191-6a0fa0fe8ca9", "comment": "Malware payload (ToxicEye)", "value": "e3eefa74529923b9e24ff86884f215e6e8d982cacc0a4a4d91deca37737e1b1b8b1b9cb065d2556bd6612d3ff89f6619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289025, "uuid": "c9eca2e9-4b07-433b-882d-8c222161beae", "value": "T1DBE3D66837FD9D14F5FFAF3AA9B251040B31B816A932D30E05D5A45E2CB3B54CA14B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289025, "uuid": "555c76f6-c5b5-4740-b02d-7f8d427c82bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289025, "uuid": "9e776941-022c-4638-a00a-378b4b1aeb1d", "value": "3072:Y/fBehjLkbhHqO/Bc51Jjo95+lYQWgXCrAZwo:DjAbhKOJc51i9kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289025, "uuid": "18059c44-5eec-4547-87d9-f0ce631f5c28", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289025, "uuid": "1b496499-345e-4204-af9e-0d46a6550ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289025, "uuid": "d667c7e8-ff40-4fab-959e-dad62b30d0b8", "value": "CyberEye.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bedc697-d533-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765307647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307647, "uuid": "ab82ebbf-ef37-4e07-8bb8-1dccf698ace7", "comment": "Malware payload", "value": "03faaf4ec48374e25500272d1f13e6ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307647, "uuid": "eeb0d608-2a03-48ad-8eda-fb6340c8119c", "comment": "Malware payload", "value": "2229d93f6a97610c642b07f6849510b6e72ac3d19ce60f13bf3df253ab7e1cf2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307647, "uuid": "ff6b6caf-e993-4f34-80cd-f64b3d22c76f", "comment": "Malware payload", "value": "7ecefa75e0643a8dd464e701d3a5d57ae37392f3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307647, "uuid": "1a0258cb-b53d-4c40-b5e7-b6d4f52baa01", "comment": "Malware payload", "value": "8f854f2319e96a1954c0026112b9e55715d27c3a10211e742b28147fe6d3a650c158d57333bc1977ff38f71aef295b1a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307647, "uuid": "84e23060-2a0a-44dd-851e-56c30e0771f4", "value": "T14B74D056B3E520FAE1A79138C9A10626FB727C2507605BDF03A04775AF273D0AD3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307647, "uuid": "d6227888-f743-4d49-bc2e-5047f469a19d", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307647, "uuid": "c5158ac8-c4e3-4f01-aa51-5d7ab7cd5592", "value": "6144:voQSzxEvIpBA/mSXwapvbV32EI7Z6KWwGf4Cck88NJ:vKF6aBAuSXwadbp2EI1MwI4Cc7OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307647, "uuid": "0347fcb7-b714-4afb-83e1-20830e0b1c04", "value": 350997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307647, "uuid": "be2385c8-db1a-4d5e-a5fa-89bd257c8c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307647, "uuid": "0b5563eb-a945-4bb2-a6f7-50b1f74ee68f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9721d6a4-d4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765268716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268716, "uuid": "8ffce3f8-e4a9-4b22-9bed-e8daad73a731", "comment": "Malware payload (AgentTesla)", "value": "cd180586205708705712cc9b3510c442", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268716, "uuid": "53a5a92a-8f5a-4daf-90ae-8e77928a0299", "comment": "Malware payload (AgentTesla)", "value": "23639854fe3670be010755514ab0cbe420ae48da8b13f8043f6ba176c6d62202", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268716, "uuid": "e0206f0a-451a-4b8c-8a87-df1651dfc87d", "comment": "Malware payload (AgentTesla)", "value": "796c3181c98620760e2b78fdb3f0e9045a42ca53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268716, "uuid": "de5a3edd-422c-4535-ade8-5f7e63e0b1da", "comment": "Malware payload (AgentTesla)", "value": "747e0c44dec838e41674849196d67a0139c53426a4c2b73a51fc463ff470e586909b49b9fd5ab4a901bccf83cce72b6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268716, "uuid": "5e7c5974-5479-4512-a03d-a32245acd3f2", "value": "T19545BF0273D1D062FFAB92334B56F6115BBC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268716, "uuid": "647dfb55-85c3-4dcb-a276-728b1b1e23a3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268716, "uuid": "591ffd20-5d46-4fce-89e4-18688b16a980", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdakkXDIUFLwwCcgonz:JPVt/LZeJbInQRakW8gio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268716, "uuid": "42c3bb5d-667d-445e-9f41-ff34df7a89d4", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268716, "uuid": "adbaccf3-6624-4c8d-85bf-07924fcb0d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268716, "uuid": "8d984fe8-efc2-4b06-a44b-27764ca9e4b9", "value": "689504271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7a1afc-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765279195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279195, "uuid": "42300b20-476f-4a13-a985-2fa862957a0a", "comment": "Malware payload (VShell)", "value": "4fcd9c861be1a07425506e04e6e6bb37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279195, "uuid": "ff794d3c-3df3-42ad-84f8-ed7e2c0eb293", "comment": "Malware payload (VShell)", "value": "251e8f53e66d26f748efdab49a9b92e07eaaec71e83bfa932ed8fb7322df2cb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279195, "uuid": "e65b616b-a9ec-4096-8adb-28f5b1dac1ab", "comment": "Malware payload (VShell)", "value": "3c0566d5793fe4326df57efaff9cce9dcd3d5357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279195, "uuid": "34e7a85b-ad6d-4195-bcdc-4397f70151fa", "comment": "Malware payload (VShell)", "value": "53b8228579f6539c756258f13e2d77206c1a3e9734dfba6c3f90e5f77065e5f0ab52df595245c85879d0b70dc2fabca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279195, "uuid": "d50e3515-b47f-4822-a894-44753d35cc97", "value": "T1AC762A47F89050E8C0EEE174C6669263BA703C894B3067D72B60F7F42B76BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279195, "uuid": "691d42bc-805d-472e-a6b9-11f7baab8045", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXE:glRJXp8L/KyZcCb7IeEew+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279195, "uuid": "d19fb0cd-9087-46e4-a3ec-e9f8841922a0", "value": 7168120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279195, "uuid": "65d9e354-afda-4b97-abc2-9529c2419302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279195, "uuid": "b3841a1f-1618-4f7f-899b-3552c66ca3d1", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4538f2-d4f1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765279569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279569, "uuid": "106dd795-d2da-4008-a259-6d796722ddae", "comment": "Malware payload (AgentTesla)", "value": "9859c5a46b04685226df26aa9d72491f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279569, "uuid": "cdc16f66-1b52-401f-b027-0046c40b0a3e", "comment": "Malware payload (AgentTesla)", "value": "26150a290514a318deb94526382b4d55734178e80bb7ea516d393c5ccbe2b58c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279569, "uuid": "19890eee-f719-4fdf-b11a-dafa9a1634e3", "comment": "Malware payload (AgentTesla)", "value": "2be029cd97dcd1a52acc47a4162bfbfb2e077236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279569, "uuid": "7be3e203-32ee-4efd-855e-19823c93b719", "comment": "Malware payload (AgentTesla)", "value": "900f2daf9f9ab139fc6a6156d2720b94e5abec960dcad278bfa332faaf782d9d43eb452918a4f1ba81d7348d519b1287", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279569, "uuid": "e1a6c519-14b6-442d-b45d-99cb360158f0", "value": "T10283748463C0B46803435FBABB2FB1E9F96F09D934A9494BC121FD90B574706EAE1D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279569, "uuid": "4f2581a2-5ef1-4268-904c-8d72171d39f7", "value": "1536:2fh/2ebWyEq4zoCL0IQuxGm6P3R+pvWluE7XxtWvxgL:2fXF4SIu3aOluENV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279569, "uuid": "4a452b57-8d0b-4599-b05e-c783daf3704b", "value": 85323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279569, "uuid": "6d67c6ae-b2a8-47b9-bdfe-8b15770ac3cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279569, "uuid": "8558ba39-21e9-4684-be76-2d60ce80c4bd", "value": "payment proof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863e2479-d545-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765315503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315503, "uuid": "8559e432-b08b-4b97-8fac-614981d93a72", "comment": "Malware payload", "value": "e66944963117f588d929c31801df06aa", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315503, "uuid": "e3f68ef5-1112-4583-ba4f-a7d73d486dc4", "comment": "Malware payload", "value": "263f1db1c1eafd6757f7ca97bd9eef9c4df026777d1d5db133c4482e9e70251b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315503, "uuid": "09047467-9f2c-42d0-8c85-3c361733aa25", "comment": "Malware payload", "value": "72bf28d398e9686f07188517354df0ba29f3b3d9", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315503, "uuid": "50d2305b-c00d-4ba1-be8e-247676b0f62f", "comment": "Malware payload", "value": "051feb29d4c54bbb104493c3eb69c1ba7f08a39dc54e26fa352227f7220e0d8313ca3715afca3de902020f8c4e2813ab", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315503, "uuid": "9debe73c-ff5f-478f-a694-7dcd05b688cf", "value": "T151041283F9090CB4D537ECB0CC4BE7A5B69A7810D8C645A6D64D97C4F11A342BF1D6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315503, "uuid": "61ff23ac-dadb-4a4e-889a-8265285eb9b2", "value": "b3486f6879078d2c0cf99a03462df509", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315503, "uuid": "a3196164-36cb-4b0e-b955-b1e2f5f2eba2", "value": "3072:BqVjlXVL6WrxuU5fSgdG6VEIa9B65QcrfJ/FqdSfbKQ5A+:elJVuc7dG6V6QjTJ/FqoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765315503, "uuid": "77e38986-ae0f-499a-97c5-662405766250", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765315503, "uuid": "d87b3b06-1b55-4f1a-be4f-04ba649053b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315503, "uuid": "d40b54e1-30ae-4c6c-9437-7ede8d71c86d", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2d6ba7-d4f5-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765280988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280988, "uuid": "1c975d6f-3dab-4578-940d-a8ec267e8baa", "comment": "Malware payload (GuLoader)", "value": "d05a21133aa5d08220b385965bf678d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280988, "uuid": "e5e694ef-4274-4630-a746-adc2347cc4c5", "comment": "Malware payload (GuLoader)", "value": "2803a6af28d635b93ad31a5a9d129bc4a4e143700013b1d660041aa02ccfb799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280988, "uuid": "a79e448d-224a-4e0e-8582-0afeb262a0af", "comment": "Malware payload (GuLoader)", "value": "d29b72f0bb0c7606844426ce7b087b9ce5593b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280988, "uuid": "7f13d585-6903-4fdb-b55f-6ef32daee6dc", "comment": "Malware payload (GuLoader)", "value": "6cb8e5bf0ee8ac927b3e9160e7c589564f5d041672c6181353f52ae7f8ed033f135eae9e591c9328adc40eb8ca934001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280988, "uuid": "11b24458-55a1-46ee-a71b-6f36a3dbc23c", "value": "T1BC940244BB54D5C3DA934E304D73E232DAB4BD062E214A871744BF3F2EB3592EB09A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280988, "uuid": "1853046d-35e6-4137-8d8b-983861864038", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280988, "uuid": "11e0be77-2d96-474d-a7e9-168285a82cf7", "value": "12288:IXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmoxUj+1QRTWRKGVRq7vrotF4oIOs:IXiR7PA9QWY+0dYHCbDqfZeFIWv5pWm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765280988, "uuid": "ffb18d9f-d72b-40dc-8567-a798370d2475", "value": 428976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765280988, "uuid": "8ccdc75f-9eee-49b9-b777-90c8fede2bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280988, "uuid": "d608acee-f35d-4fbe-98c4-548cffa23b6e", "value": "FACTURA_081225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2c91fa-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287916, "uuid": "4e9beb27-5b02-49a2-ae98-eec3dcb74cea", "comment": "Malware payload (Mirai)", "value": "aa5434392834dfa457e60a11fb8303fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287916, "uuid": "752fae15-fb98-45af-a008-a2ebd84bea3d", "comment": "Malware payload (Mirai)", "value": "2851ac567094db9d394127b3ad7176f728031c63a3e4198b262417d2db20e742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287916, "uuid": "5fe8dff9-b247-43f8-a661-5f0be198b95a", "comment": "Malware payload (Mirai)", "value": "9623e0e0492dc371bf41c9d6c079cbc6dfcc5385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287916, "uuid": "a0647f0f-8639-4458-ba2e-dff7138f0748", "comment": "Malware payload (Mirai)", "value": "1cc375552cd8104fb4586689a9d6cab320200455545c047ba0a5ed3f694c21c56b3164cbc3409ac1fa55ab5a2ef5a310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287916, "uuid": "ed260fb1-389d-4b72-be3e-a48d4fb08805", "value": "T12783C519BF601FF7EC5FDC3B45E9274524CCA50A22A93B79B938D818BA4B10B45D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287916, "uuid": "ecfd11aa-09ac-4dab-b17a-3abee2264f0e", "value": "1536:8FHGqRoH/tQ2gPFJ15FgmQI3yvA2eQ4iZGbp11wummHoB7:8HRoHlQ2gtzPgm93yAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287916, "uuid": "77533f47-099f-468a-b52b-d3b83c030096", "value": 88232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287916, "uuid": "a362bc87-7ebb-4373-acdd-6730f176eac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287916, "uuid": "c4849451-33f3-4d1c-9b8a-2239f9ab9985", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4292c9d7-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298209, "uuid": "d89ea02e-3ce7-4674-9551-65ae81a81f84", "comment": "Malware payload", "value": "9422e7cae457b55137c7f3eb63cb4d74", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298209, "uuid": "bd55fcbe-184e-4c2c-9ceb-5677c744dca3", "comment": "Malware payload", "value": "28b7e901fd7478a6d1647304c4ba5eb899527c921493aae918e613a9bffa8148", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298209, "uuid": "a9fbcd44-d1ad-4517-96d0-d7585aac5c02", "comment": "Malware payload", "value": "104734edbf19a428be206bc51d3c249a2d80cd64", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298209, "uuid": "153d35f2-a59a-44b8-8107-4352c300ea15", "comment": "Malware payload", "value": "ab81bdb8393a818e73e27818060762777049ac1921dfe58f2ce848b448e30354212caec67f5b8c603d0a40fc9b80699c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298209, "uuid": "68fff0c2-2c03-42e0-a74e-06b7e8e2bfff", "value": "T118E5331027A518CFE45B58E90D17AEF79CE4C8C157450C58DAB9FADB8E29B3BBC0D260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298209, "uuid": "dc91b6c7-0286-4a7f-bc3d-c2ef135bd73c", "value": "49152:eefx04rs3g9C3wW1hUjiWXrCDopGsy6ZQY0TSKyXSUfZpun0ZRjjSnXgoPm4UxFT:Tfi8sl3wW1aWW70opvyZpThcun0ZygqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298209, "uuid": "16c2309a-f2fc-4c7c-8248-c83b74dde94f", "value": 3054796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298209, "uuid": "6db058f2-74e4-46d7-9b4c-98cc70764172", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298209, "uuid": "a6ddf24f-94d8-4936-8711-8d80d1907778", "value": "v.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d5ebda-d4cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765263206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765263206, "uuid": "d8e9fc2f-68aa-407f-849f-4e19d1d67cef", "comment": "Malware payload (Mirai)", "value": "a1ec83fa8f7c13a8d72e6e626dd37bc0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765263206, "uuid": "347e5c2f-8787-4090-afd7-b3c6880426c1", "comment": "Malware payload (Mirai)", "value": "2aa36ffb8713cbd1abaef6651638902ac329a666b114e46bd767224747a8ef92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765263206, "uuid": "8176a11d-063f-40f1-969a-186495def0d3", "comment": "Malware payload (Mirai)", "value": "5cf2530dd1488e8d150d9031e3bca3e16a95c96a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765263206, "uuid": "87b961f6-2aa0-4a1f-9d6c-bcc555ba4222", "comment": "Malware payload (Mirai)", "value": "72079db3363bec450ad75b11957a9a10d14e6ac9f8a1ea5b47f95db88827c7d02aa54c42e74c084eaafaf4997c338c6e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765263206, "uuid": "08af04f6-4a29-4765-b99c-54e522788e07", "value": "T1FA219ACA32B1A10074ED8D44729BE40CE1759AF1E9F51E19FCCDBC79EAC5A19B209F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765263206, "uuid": "eb1beb4d-0261-4960-a8f7-fab151c62d42", "value": "24:8IvLc9c3NIZcAKHcCcTSWcZPIcncplcccFgc3HR:8IvLc9c0cA8cCcTSWcZAcncplcccWc3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765263206, "uuid": "1c1345af-b5be-4c32-a7b1-7753201a28ca", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765263206, "uuid": "ed2642d2-33fb-4fdf-860d-8f886008c280", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765263206, "uuid": "8c7476a1-5019-4113-9b30-adc0eece59e5", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cf86f9-d54b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765318159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318159, "uuid": "cd3a41cb-9f85-4e23-b57e-b92de2678813", "comment": "Malware payload (Mirai)", "value": "bce1b87766f1a10e38378eac89c148e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318159, "uuid": "1012a7f7-b8cd-4744-90d3-c0f96d5180ad", "comment": "Malware payload (Mirai)", "value": "2cff5d24baefa482cec439ba577b70f5f7827a5bc3ed6251d99f98f304b5befc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318159, "uuid": "ec28c848-0943-489a-90f0-4bea0d041f0b", "comment": "Malware payload (Mirai)", "value": "34c386f8abdc787981ad382e04c4f0fdd385def8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318159, "uuid": "9389b301-eba7-4e5d-ba2b-9f39f5bcbf47", "comment": "Malware payload (Mirai)", "value": "ce3bddad23329883ad4e40d68361c72a5cbc5167f92cd978babff5ed5f7d0b114e4a9750d9b993f5209494e19583708b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318159, "uuid": "930f2665-d1b7-4c2a-af20-ecbe3dcc11f5", "value": "T1BB343945FC819E23C6C516BBFB6E028D371A67F9D2EA31038D241F6436CA85B0D7B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318159, "uuid": "0d21776b-ca81-470c-8444-0a0fe3378e28", "value": "6144:mOdHKS+bAJsuvs5yZGeE/4k4JrakHAp9n15DZMv:mOdKSVZFE/4kGuQATna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765318159, "uuid": "e207367a-af8a-4d58-99b1-0f326bdfa1b5", "value": 244832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765318159, "uuid": "ac8b25c4-4059-427b-b88b-3198df026aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318159, "uuid": "11d80e56-1df0-45bf-b9a1-536642b42bb1", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1094a8e-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248116, "uuid": "f65907bc-4368-4cc2-b789-ce6267ab2edf", "comment": "Malware payload (Mirai)", "value": "9b3bdf7a629acb1828876ff343a243fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248116, "uuid": "b967972d-1c7d-4e62-a084-7b85bf84150b", "comment": "Malware payload (Mirai)", "value": "2df8a7ceba4b1648f689d6fcee1ee41d0ca9d7bdc611a65c6c3d80c17ca89cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248116, "uuid": "4892159a-b662-4c48-b9a3-ca6c3fc5ec8a", "comment": "Malware payload (Mirai)", "value": "0157606286c04f0f4418c3a8c664220e6be673cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248116, "uuid": "377b509a-3911-40f6-8b23-52638897da80", "comment": "Malware payload (Mirai)", "value": "ac89a942eec1ace3e943eb2ee989aa2e7d9970ef555d010eb6727212a73f77f5514e212250db37c2554fd235884689f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248116, "uuid": "c411bb11-3aae-4aab-941f-aa871a197eda", "value": "T1A404A8449C645B2FDBE3AFFBF75471CE727646891F833309D3284AB013816DA991A253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248116, "uuid": "468068c9-a5e4-4eb1-9b9f-b7c6fed8b5cd", "value": "3072:wDeT4tGXq11zXqwL5SuNZf1t3aLUUGPNiibtNf8eNgJs12Khvc5PsEsEUxxQL8Jv:wem7Eh49ZjbpVVeL7oO5Dt0DR1M4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248116, "uuid": "403acd52-e5fc-41bb-8e6d-5d8ff1cd51de", "value": 189147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248116, "uuid": "382c31c8-fc7c-44b3-ab7b-c7db150fc897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248116, "uuid": "c3f87e64-2a4e-48c4-b847-92574d20e1af", "value": "Demon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32773d39-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765307631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307631, "uuid": "82b68c86-aaa1-4aea-a5ba-e097a45667d1", "comment": "Malware payload (Stealc)", "value": "8d0d3c6096e3fdca77f70c49c829b345", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307631, "uuid": "082bc4ff-dd29-4f82-a162-58662d9135e7", "comment": "Malware payload (Stealc)", "value": "2e16f69641a223aaacdf4f55696a4c6cae94a1529d2b801a4b50e6044e7d6794", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307631, "uuid": "19e27a19-46ab-47e3-83ec-e776c8183f26", "comment": "Malware payload (Stealc)", "value": "7b71f78c167d225c71c46ab4fc7dc18b02375b79", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307631, "uuid": "4759576e-b408-40c4-a486-7ee2050a36b7", "comment": "Malware payload (Stealc)", "value": "43d0272117de6ad2a67eb01b6fba23b2a6c265b93b8829cecd0682808a933f77f445d0e54a2a790573f8ed7e708043d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307631, "uuid": "d690fdb3-f615-43d4-be61-ac1357d65ff9", "value": "T17836121BB74E673DF8399D3559B2AA04583F6B61651ACDE3C6F00A4CCE3A0641D6FE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307631, "uuid": "90912d36-fb48-4f07-ab78-bdf17a5cef37", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307631, "uuid": "99b616a6-3cf0-4468-81c6-54c1e5842c63", "value": "98304:9DbLhd1FnlfpnIN1W5RhpwnrCw2Mtq5NMky1H8KgUCx:9DbLhdFfpIbW5Rhyuw215N5y1rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307631, "uuid": "f63cd2b6-5cde-48ea-a3c5-104a1db07571", "value": 5035994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307631, "uuid": "04f8413f-7fcd-4006-919e-fd77e1afe1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307631, "uuid": "65a3dfbb-b3c3-4e82-8a03-3af8e2ee7d37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73527e74-d522-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765300438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300438, "uuid": "874c4d26-f7ee-4f7c-ae5f-ea2deb83fd48", "comment": "Malware payload", "value": "6cc1d42b7b787f00399105b8fc04838c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300438, "uuid": "4cda6e24-3dd0-4a4f-9c80-0648212d72ab", "comment": "Malware payload", "value": "2e1b81ee5683d4d6c3250383ca677efb0dd1a9950a394865e94465e1f4e575da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300438, "uuid": "2d6408d4-3338-46a8-b4a2-dc5dc1539c63", "comment": "Malware payload", "value": "3bb67a88905d5c9bd59ec080d4e0815475ad2ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300438, "uuid": "2e73aa89-db4c-4a34-b62c-8be8d953bb64", "comment": "Malware payload", "value": "519c275f5fad5b62efa13188a2fc5979a4c2ac072b3933ce27341e122250a74bba535263b5d4779a152f4d7999487b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300438, "uuid": "11313d1c-35ad-48fb-9625-551da77868e8", "value": "T15F137D4173098913E1973EB0683F3BD2D7AA5B6021B4B387794DBB8D42B6E329507D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300438, "uuid": "46d8027b-66aa-401f-8a8d-fb66f929564f", "value": "768:mdXGeD4ySE4EqAhD5ROfUQJ+bMRPAhPqb4ReTLT3bsRH:mKySEqKd8LQy+PDRqLT3bsRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300438, "uuid": "41cebc9e-550f-4c27-86ef-34d9eb3861e7", "value": 44816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300438, "uuid": "94303836-ac4d-48d9-bc18-886d574444ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300438, "uuid": "ebc3500a-13ae-4a9f-a6bf-d6bfbd67680c", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2953333d-d51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299026, "uuid": "7e517555-42a3-4996-b695-bda33f1410b2", "comment": "Malware payload (Mirai)", "value": "68a9329024d40ec97428fc4ccddc7457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299026, "uuid": "5273260f-5485-41e8-b27c-c04355c2b5c0", "comment": "Malware payload (Mirai)", "value": "2e2edfb5e2b509859784c99ae484a2bcf2dd14418d8fbffdfbc55fae46dfa76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299026, "uuid": "aa4426fd-be2a-4a8d-9b7b-6c89aaed5fb5", "comment": "Malware payload (Mirai)", "value": "fbe8688234ff9b5391036c2102b509fd4f783502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299026, "uuid": "f40814c7-6c01-4d82-926b-482cb79679f6", "comment": "Malware payload (Mirai)", "value": "cdaef5b1388ee7b4574852458c88b31b63d7acb71cdd996d26eca2703b0bce598e7697f5ad3b1c25cee8996f1f7072c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299026, "uuid": "d5448b9e-1102-42e7-b7fa-b656d330e6e2", "value": "T17AC37DA82E4E3DE2D2C7E37DDE044E62712B74F1C66193B07D1213AEC1DBCAA99E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299026, "uuid": "9df2aa18-5b74-4e69-ab94-ee276f2c6fa6", "value": "1536:NxIiYtyP6AIq1VCG+0872js4EaEq15W7vDQYFGYWfNsn4lceNcE:NxKXq1VCDws4EaE65oGY+U4WeNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299026, "uuid": "15b0940d-d849-4b5c-97ae-c902dade3d89", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299026, "uuid": "06020f95-a6dd-4212-b6dc-f71d3202e650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299026, "uuid": "3041a7f9-bbe3-469f-8a84-35252802738c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319bbfd6-d4a4-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765246212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246212, "uuid": "d02c3d90-23e5-4a24-b7d3-2b1af6b1f88b", "comment": "Malware payload (PureLogsStealer)", "value": "a1ba70ff00ae2282efe8d2e175611e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246212, "uuid": "6a7d603e-9d5e-4ff2-8300-5908d14b2f03", "comment": "Malware payload (PureLogsStealer)", "value": "2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246212, "uuid": "38c8b4f6-d539-4c95-b3e2-8206fba461c5", "comment": "Malware payload (PureLogsStealer)", "value": "2168228311e69214883173b5d8ec63a47b2ea36d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246212, "uuid": "08e6b169-3ad6-4d45-a416-1f34e3e188ad", "comment": "Malware payload (PureLogsStealer)", "value": "c76337f3eebbd694e56c3e11eb7fab9d965d8e59d1255fd285c58e30a400b76a2cb368a0a8b367458b3e3cb0e5803b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246212, "uuid": "4b04aebd-5e5c-42e8-abe2-41687bc941eb", "value": "T11EC4DFE2FCD2D406CDC116F6C82D88AD88696D2517941C4162877B7E18F728DEACD2FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246212, "uuid": "20df4700-ea9e-4aa5-8926-2c8fac9ef70a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246212, "uuid": "5816de8f-0885-4c3f-8586-e0560168f442", "value": "6144:EicFyEa8zeyw8eTpxN/fhrs3xcyYFh1+1zYeRIKg18tHmjVd2TC1DuQM6nMCYkwO:HQa8zeNx9zHOBB+2JrRn5Hwd2+13MRkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765246212, "uuid": "28a0420d-bb9a-4d50-b5d8-bdeb76b0c843", "value": 568792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765246212, "uuid": "bee8af43-41da-440a-8c47-3c9662b4d5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246212, "uuid": "33540821-234b-4a5d-9338-789568762c86", "value": "MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f3b34b-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287912, "uuid": "a679254a-b2b0-46fa-8a0c-61c9b7b4ec12", "comment": "Malware payload (Mirai)", "value": "970ed98fd79ce09d8cdcd95ed67bf3b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287912, "uuid": "a8f7430f-daa5-4430-8423-25bde62f4fdc", "comment": "Malware payload (Mirai)", "value": "2f453e026bcb5b147016977c226fa2067eac648e3640b1e3a0840448f2a08403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287912, "uuid": "c6be01a7-048d-4505-8832-e2814f436c7a", "comment": "Malware payload (Mirai)", "value": "c314e59627e9c23d652d0ae6e10044bc38a15d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287912, "uuid": "f9e0d313-649f-4199-abd1-5b0d2de15fde", "comment": "Malware payload (Mirai)", "value": "a9ab3eabf109b25bc395c5c19b8ccba2b02899f3185bb1091b96b8599d38b76865b73e79cdaec15aeb3cbd908d0e987b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287912, "uuid": "363bd439-cb71-4eaa-935d-779e93828c30", "value": "T17F735C21B6792F27C0E4F47A61F74725B2F9174E24A4CA1E3E310E8DAF5993032176B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287912, "uuid": "319bb293-ecec-4f38-87d0-f3cc6546e7a8", "value": "1536:f5iwU4ZAJZFDfYuo4mB/u++pekF6Ct8FxcS:Bi6SDgNd3+gCmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287912, "uuid": "f2d6e1ba-a664-4c55-98aa-260f28722670", "value": 76472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287912, "uuid": "634673cd-89c0-4f9b-9a46-c39ded6e5629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287912, "uuid": "b141086a-5097-4b97-94aa-8fe2e1f05592", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f515b0d-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252382, "uuid": "6ada0d56-20d8-436c-ba63-87e46b539219", "comment": "Malware payload (Mirai)", "value": "c2ce65535dd678f92fa0638a5fc51e90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252382, "uuid": "c601dc02-1e29-490b-ae09-b7a2dcb6c24e", "comment": "Malware payload (Mirai)", "value": "2fe00e41c412e3f662d2fe843c0be9b953a6c1b70c30c39c6ca75d765889a7b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252382, "uuid": "40fc9073-05e0-4701-b7a0-7aa464fbca4d", "comment": "Malware payload (Mirai)", "value": "e3aef738d07fc4d2911769d93a79ae35ecc9f031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252382, "uuid": "5203ce27-594b-4916-86f1-610882cd2bb6", "comment": "Malware payload (Mirai)", "value": "fd6aeb4518ff079cc2ef338e4adde7151dfba918c69137d6879b13f4c5a5f77838a2b97273e8a9855504c880b814888b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252382, "uuid": "0818d287-6f0f-4d92-bd0e-a16575b4277b", "value": "T155F31A56F9818B11D5C255BAFE0E128E37231B7CE3DE72129D246B707B8B87B0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252382, "uuid": "8555cf22-b025-4685-a0e6-575fcc460b06", "value": "3072:xz3mmuMKgtMhc/X6wU2LkEFQPrYIPt9GBGtaDRb15ci33ujFfCzEEz/iJW:xz3mmuMKgtMhcf6wU2LJoft9W6atx6wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252382, "uuid": "0d34485b-368b-42e6-8d9f-91892ff28484", "value": 158908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252382, "uuid": "86b17a60-ae0a-4bfa-9107-459cc558e152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252382, "uuid": "5bf9a0b8-6685-44d1-a166-c37d3b9affc6", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943abd30-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252390, "uuid": "b9a371f6-c078-4a2a-b2a5-fb82f4fc2f96", "comment": "Malware payload (Mirai)", "value": "62d5748cbe1091b302410cbf10e3b528", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252390, "uuid": "b1ef2d16-d76d-44b8-8a93-de172ee9409f", "comment": "Malware payload (Mirai)", "value": "302bf124600eb11607e4e1b0bcacfbf7aaba221f44ac6cf6da50a3a6a9183f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252390, "uuid": "5ba6f420-b912-4799-8988-1c76adbdca4a", "comment": "Malware payload (Mirai)", "value": "86c07f3891ed1173700ff233491affb59a5b76ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252390, "uuid": "b61b571d-b13f-43d2-a1a9-0161e030e754", "comment": "Malware payload (Mirai)", "value": "772e331419c4a7b6505984e0cf2b336e0f45dbbc07be4168bab9eb196c5b12ca7763b60f1f05a77e7e81f69368b5fcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252390, "uuid": "ba65845c-c2f1-4935-b714-172b7f3fceae", "value": "T15914855E6A228F7DF678C73047B74A30975D33DA27E1D684E2ACC1145E2424E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252390, "uuid": "fadfe443-6fcd-4f64-984f-b9e88dc0288b", "value": "1536:y2DHwKk8rN6B8OeCJzNZkIRdM+PcTF7u8700eMmENWJ43uI+T/mZfbAB5Diqk0RO:y6QyNqJzFRZiF7V70IQJOHZUB5Diqkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252390, "uuid": "6dd0b656-18fe-4642-a9af-851d3cfdaee0", "value": 194784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252390, "uuid": "e4198c7c-6ee8-4993-8abc-57fc021e4c93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252390, "uuid": "ef2291c2-64d1-426b-b741-9d55e1e1ecf0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a3e28c-d4ca-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765262566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262566, "uuid": "09050d88-c481-43fc-99a7-6a78252d86de", "comment": "Malware payload (RemcosRAT)", "value": "635eb2e57f76ebe3f4766c70395eb355", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262566, "uuid": "74733cd8-3200-4fe8-9851-e3161599824f", "comment": "Malware payload (RemcosRAT)", "value": "3077001145281f55a792789b3426ac3b45f7c83aa315bdd9f9a5b8fbcc3ffaa2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262566, "uuid": "e4d6ad10-3cab-4a0e-bba3-980885798b73", "comment": "Malware payload (RemcosRAT)", "value": "ec66c8afdc106e68c5861b49d1f47e82b04bff3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262566, "uuid": "d6bb2d30-b322-4ba9-a68e-fa5713c6617c", "comment": "Malware payload (RemcosRAT)", "value": "f8838bf3a37f532040340fb2adc5a3b0a064324d9d45358b4b3550e78c7072f6ac8317dfb7dbf19251a2f124df3db522", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262566, "uuid": "14cde6f0-dcd8-4d80-b5fd-a239f3b1fb15", "value": "T1BC844B20EE3406790F471BADFD990B62CAFD8609462650F1F6DE070E61065ECE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262566, "uuid": "4742e2dc-14d3-42b2-9837-59dd6843d399", "value": "6144:82A6xrSO9DN35goBcmOn2mfKjeiD5P4yL6vLn9iDMtnMi6RXo6E5iUXyFOVjgzrn:rVDJhB8nfEfOAghwOXygO4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765262566, "uuid": "99524a16-a22e-4c81-b788-26932102a6f8", "value": 387113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765262566, "uuid": "a630b755-9ba6-42ab-85e5-e841760d7d99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262566, "uuid": "0be9448f-38eb-4aa8-a392-6c8ccca2fee3", "value": "Annual_Benefits_Employee_Bonus_Package_December_2025_PayList.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921d73cf-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252386, "uuid": "732a50e9-53e8-43ae-af8d-35d5e639739d", "comment": "Malware payload (Mirai)", "value": "2f80e40a642a3d5aa515ef68eed03a88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252386, "uuid": "b84d8c02-c640-4706-be87-7898b3cad751", "comment": "Malware payload (Mirai)", "value": "30bb1077440b30fb0fe122c673c4d685028444d6ca2903ee652387af2b143f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252386, "uuid": "19a69faf-841f-4fda-bc40-9f2e9d74e2d2", "comment": "Malware payload (Mirai)", "value": "28d2b8cd812f4932b6eb8f8c4d5fbbbc3409ed1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252386, "uuid": "d4d65779-6d0b-435d-9ea1-61b31014e6eb", "comment": "Malware payload (Mirai)", "value": "a21f08d79052cae0eb1ad001aead7e60492b05523e5751976a4f8e064d4156c5d97b317dceb6422fa87e894f57c3acc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252386, "uuid": "37613ff2-d693-42a0-b941-35f6494fae4f", "value": "T130E35B01771D0A43E2636EF43F3B27E1D3DF9A8120F8EA44251EBA8991B5D321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252386, "uuid": "7eff317d-6369-48b3-b1eb-1ec9ccf31402", "value": "1536:r11/rF12k3LeInEiNcoxa+bK/7yuvIY6m9GKqgWmqhRJXovAAvHyKReMnAJKq5Wt:r11/r/LBxDITIKqgbq19Agjisn1P3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252386, "uuid": "6bd3e43e-ea6e-4272-b1bf-a83b0046d883", "value": 148276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252386, "uuid": "5f4a5761-8eab-473e-9bae-430421bb1df2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252386, "uuid": "155d14a4-9bb5-40d8-b934-5891011e440c", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f22b4-d50f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765292407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292407, "uuid": "f7de0057-583e-49dd-a4bf-65e55fc255d8", "comment": "Malware payload", "value": "0eedfc0f84826f3fa26d790a3391ae11", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292407, "uuid": "64885b00-69a5-4523-9961-0b123a2ff962", "comment": "Malware payload", "value": "30f5eb5dbd68c4f89bec483da5d30044f4366f68df6c26673ebac63df2561bcd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292407, "uuid": "e24608e7-c208-4f0d-91ae-fefaf09d9fae", "comment": "Malware payload", "value": "972218382c191d044c80a562cbaf3367db4a2e5e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292407, "uuid": "b8cbcc97-688d-4ac5-a959-aabb8002f9f9", "comment": "Malware payload", "value": "8f69c55236ddbe5f5d91543a621014c33e186d008591cc68b32fe0363abaf7ccabac89a58c4b3f1b36e9f3d0296f7501", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292407, "uuid": "9485672a-5269-4cc1-904b-64fd96e241bb", "value": "T1FC85C1CF47AE4909D6BC1EB9EC01ED8B57EB72471F45236A740FBAD5E004864F580B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292407, "uuid": "03d731dd-7e30-45cc-bef0-1732a288bc2e", "value": "768:DPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPg:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765292407, "uuid": "9706fff4-49bb-488f-9df9-11f57a592b23", "value": 1867099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765292407, "uuid": "1e8c266a-34db-4bc9-b1f2-5b45c83e9587", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292407, "uuid": "2f1f2039-fae4-435f-b159-edc4837e41a2", "value": "z1EMATRASONF170150.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bd86cb-d517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765295716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "5dc79025-4d2f-45c5-9a3e-a2982174a0b7", "comment": "Malware payload", "value": "0ad01951a8bfebacc62a0e93c7b2265d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "c57b58c0-2a09-4952-889d-f63f56bb3805", "comment": "Malware payload", "value": "312b2ec093ef1f61d8b3db70784aa5a946ac7a772a15d1482f5e32f65e607eaf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "448938a9-abb7-4803-a8ed-a3fb2a624ce9", "comment": "Malware payload", "value": "7b000d471b030f69adec0461f6f11a9dd66d8e64", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "e166aa13-267c-489f-8c55-d2fb742c06b6", "comment": "Malware payload", "value": "329894f578d556cb67afdb633cb26db90d8bfa50d96bb0d8335d2a556aabcbe6f0c2243ea1270a029f03d7ae5685d738", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "5472435d-db71-4494-8e7c-a7f89be27c36", "value": "T1C8862842B98D4575C69AF33C916162907F357C6943313BDF2FD84A6B0C2ABC42B3AA1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "013c9f5d-db5d-49ce-8e56-5823836ce177", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "3681c620-6208-47e1-bd12-2355301882c8", "value": "49152:+0aay83sOFL54qGb3z5YtnBuvrslRicSbJCZ5RNAPTboK1ysn:g83TID5YB4sJSNCZnNAb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295716, "uuid": "7c060663-bbb0-43fd-8318-e862ac6abbff", "value": 8500864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295716, "uuid": "0a249513-6484-4ada-bfda-16950e2c026d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "176b2a02-caa8-46d9-b731-77192af4284e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3842fd0-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765286480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286480, "uuid": "39b06223-0812-4003-8d22-39b4b8ad614a", "comment": "Malware payload (SnakeKeylogger)", "value": "981ab1031b451945bdbb8466a68da32f", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286480, "uuid": "cda2e734-7a24-467b-8ff5-5588494d7152", "comment": "Malware payload (SnakeKeylogger)", "value": "319d9ad6a4c1c1e3224df1c15015a998dfbbf33e4898759649f0cdbd4a403daf", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286480, "uuid": "afebe56d-4295-48a4-b116-e63b4d945cd9", "comment": "Malware payload (SnakeKeylogger)", "value": "5e6444b76ac0fd8d08260994eb3574505d393fba", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286480, "uuid": "da4ada8a-b4ac-4c03-8f70-7baba47f234e", "comment": "Malware payload (SnakeKeylogger)", "value": "ea782408a4db40a599a89d37f773575708f8a74b1b3bc940537fde924daa8f1791504775cec8af836ae74b6a526612e5", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286480, "uuid": "4690d69a-5a4c-43b4-92f3-0ea80ad37134", "value": "T12A950036BC24F1C6DDE9D062DFADB1B8134840963A01FFAEA4E679B0084568CDF25F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286480, "uuid": "8ac14eb8-44b1-4b19-a0e3-5fb28b0dcfb1", "value": "1536:7rC/dtpPTRlDmR5291WqfEoekd0btvRWSjOCVoueQjleaW4jwZ8tm0TXjtee3zwh:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286480, "uuid": "79949426-0465-4d1b-a6d0-7acd588b0a44", "value": 1968955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286480, "uuid": "9e7b1692-1845-4efa-939f-bc0f99a3c839", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286480, "uuid": "8a3d0fb2-35a2-4cf0-8e88-2575ef74e1f1", "value": "hesaphareketi-01.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79acc453-d4ef-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765278545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278545, "uuid": "a46b9763-9782-4536-a683-f136970392ea", "comment": "Malware payload (VShell)", "value": "a3ad68a48db215f57bc3dcfa93c0600d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278545, "uuid": "fecfaeb3-e562-44e3-853e-23196d2afccf", "comment": "Malware payload (VShell)", "value": "326c7404a30b313f2c2ac1d6cd5ede0b1238fcc7fea2d546919bdb3d71366b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278545, "uuid": "68cef45f-8071-4202-ad0e-5d214d213d8a", "comment": "Malware payload (VShell)", "value": "a46efc240760edb88e0a33a290c49728e989fe51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278545, "uuid": "d8f92322-0d99-4fe5-96b2-8db865d6ce57", "comment": "Malware payload (VShell)", "value": "4cbe2b5deb9053378f516ed9a260d8b7653176e21261193c337208719d841631d57a48b918d43946aa7ee4813704009f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278545, "uuid": "b66618dd-52a5-4246-97db-8242578e9416", "value": "T1A8662B47E89151E8C1EEE174CB669223BA6138C9473037D72F60E6F02B76FD46A7A314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278545, "uuid": "6f20b0c5-a6f2-4b82-9572-4714af16c158", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPX6:glRJXp8L/KyZcCb7JEewX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278545, "uuid": "56e9b6e8-3596-449e-92e7-2320ea9ada97", "value": 6787816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278545, "uuid": "573c8df0-3b59-41de-9fea-176047009916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278545, "uuid": "7b687713-7d72-4792-a0e8-6d55cdd4facb", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e802ea0f-d4f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765283025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765283025, "uuid": "73ce9f10-48a0-49f7-99ed-be0e0e7d5c16", "comment": "Malware payload (Mirai)", "value": "30b62a238ba30dade344dd7c65911e2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765283025, "uuid": "c4103668-2945-4063-96f8-057b1b77f9c1", "comment": "Malware payload (Mirai)", "value": "32a784c0742c349e62a2ba667ee548a9ce22d5cf43c34ec9b6e4b608296ec18a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765283025, "uuid": "2c95715f-6597-46ac-8dee-b88ca0d042af", "comment": "Malware payload (Mirai)", "value": "6749cfdcb55f00b9720ac85a9b5f4c499ae90cff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765283025, "uuid": "4d8078ad-644e-4396-a389-ebc1d951c650", "comment": "Malware payload (Mirai)", "value": "94d1355d790c867dd75f487b93a06ba928ec055b5d3f030b0bdbf4d31afe125cd409753ad18d12ec053b9978f601a765", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765283025, "uuid": "705c3e28-5134-4682-af61-853157a2cb7c", "value": "T13611938E1154344A8548CF4974AA4AC4B7FEFAD4B0780A079AD47CF7D489603B978FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765283025, "uuid": "a8de0f32-3ee4-4789-af64-7db76e9197e4", "value": "24:OE59EcyNIZEtlEVKTS3E3eMVEOmMETmEH/EKPlEzsv:FLqyQSEeemp7dPCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765283025, "uuid": "773df189-8bd5-41ba-8171-9bd74de306d7", "value": 865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765283025, "uuid": "9b1675cb-bea1-4e62-a78d-566a33e9e47d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765283025, "uuid": "a4e3c922-3ecc-4af7-8701-fef07430a01c", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbcc67c-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765286474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286474, "uuid": "bbda82d4-32e3-42bc-93d3-f8330bc8c06b", "comment": "Malware payload (AsyncRAT)", "value": "ae94f95e54e4528dca41573070704d70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286474, "uuid": "0981e645-da4a-4568-8024-97e690f815b5", "comment": "Malware payload (AsyncRAT)", "value": "33d7a4090740d271b9b2743f18849086c2cb50a6fa348f6549292c4769beeb06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286474, "uuid": "f1af269e-c8e4-459a-8526-a32cebc6b6da", "comment": "Malware payload (AsyncRAT)", "value": "5b900fbcf5b3e71f3741bca6d0ad9b75b42ebf6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286474, "uuid": "44ed3f04-ac6a-4ecd-8642-e7391af6532e", "comment": "Malware payload (AsyncRAT)", "value": "b4041374ff296d3eb7aa46cf96e3beec76ba60c27e8427ce7fc7a26d336a4be155affe24fcf3eacbf1f815c7025cc10e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286474, "uuid": "33e8c749-0914-41f8-a83e-6986a1485c56", "value": "T17634F112CC446F65DFFC3B2880FE294EABE41A8F051A188DBB2FAD4E1FB7404455A5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286474, "uuid": "300ffd49-a3a3-40c4-a29a-251807e8c8cf", "value": "6144:yOVTJRrHauXO3Pwy45M3Nmnp1t5su++7vQ:RjeSOf14dtB++7vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286474, "uuid": "ef39480e-fbaa-43a8-8d6b-5f089ab36a05", "value": 248950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286474, "uuid": "c425355c-baab-481b-a458-285912102630", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286474, "uuid": "a06bf9f9-2b37-4a60-82f2-de453aaaa360", "value": "EXW-PO8872HTYGCN89A2025P9.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698e1e28-d4f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765279806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279806, "uuid": "d38f1f48-f40b-4538-809a-e93a9a2372bb", "comment": "Malware payload", "value": "aea682cc3ecadd767bf43090d234a5d1", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279806, "uuid": "d2bb94ee-b888-40d5-9212-a489e7c52f39", "comment": "Malware payload", "value": "3490353e745720b0e942798fb9be6509d2e98128cbe125cecbb27eb49e79a939", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279806, "uuid": "da9917a7-894c-4fdd-97a9-90a3b1a3c148", "comment": "Malware payload", "value": "e05506cc958555556700d707d2815c4d7bb87420", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279806, "uuid": "d67ae0a1-0aa6-46d2-94c8-288883c84dfa", "comment": "Malware payload", "value": "d9e79e92aa30cf274dbb2d83edce7cd50e7f0d07020f49cd947e503a2f6d4eb690da8af0ff4b59b854afea505f682101", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279806, "uuid": "141e1857-f196-422e-b6ad-f83838985164", "value": "T1F5E2F2921A5DB253F1FBE0275C1A1FA3840B42D62D84E4962ED504CE21781E897FE1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279806, "uuid": "1d53dea1-8898-41e2-8994-60ac1fa28457", "value": "768:GPNAatzUd+eRv+XeazExgYWIlalboIG81MupiXTu5P1n:G9MGX5zZXIlaeZ8pp6C9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279806, "uuid": "1ab3af8a-0294-4652-8b1d-a12e6d613c89", "value": 33411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279806, "uuid": "fc355535-ee6d-4e71-b376-43dc27d215bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279806, "uuid": "eb8d67f5-b0c3-41c8-bf23-cd2a0d0d043f", "value": "nPRICE_REQUEST_.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57738083-d53b-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765311129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311129, "uuid": "1e913a8b-ffcc-4f18-aa60-7a1d64db6498", "comment": "Malware payload (RemcosRAT)", "value": "7269e9b742de12bb7ebcac2a86a6f735", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311129, "uuid": "93beff4c-801a-4a7a-929e-08a6ac6dadcd", "comment": "Malware payload (RemcosRAT)", "value": "353583a5da2476e1792702fcc5c2a32c9898e7845ebf16014513d32ce3f609b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311129, "uuid": "84897339-2872-4c0e-b4b6-d2a3d6f2de28", "comment": "Malware payload (RemcosRAT)", "value": "daf23ef9bf15933b5867d43543562600a3bf8802", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311129, "uuid": "1c6827db-d232-41a7-a91d-8942f92959f9", "comment": "Malware payload (RemcosRAT)", "value": "4c42b06ee6e0ecab995c58eef6c75d3c9084885fe70caaa521e980cd895b943f306a97e9a6005e38a2d8e686fd6b86f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311129, "uuid": "3e670f96-078b-4b46-ae91-288f3bc97cfe", "value": "T1831612C2C51732A8E96DBFE65F9E2317A327900AAD454838F321ADCCB6045EFF474825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311129, "uuid": "e0a78876-81ed-4840-bede-ca4a71e06a49", "value": "48:wqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqE:jy+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765311129, "uuid": "68c25f38-08ac-40d5-a1be-d420a9a94642", "value": 4274874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765311129, "uuid": "3077533d-66db-48ad-a6b3-dd6979bcdaa9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311129, "uuid": "cca9bd5d-1318-41aa-bd84-0e9a9d8c703b", "value": "DOCUMENTI BARCORNER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964e7504-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252393, "uuid": "94297053-54c0-4e25-8d72-75e552871719", "comment": "Malware payload (Mirai)", "value": "69538305f640fc98fc76252a13748ba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252393, "uuid": "bfbb7166-3931-4fb3-8cad-b7c8612bd984", "comment": "Malware payload (Mirai)", "value": "35c077f70e2d88f16bee7cb5ae62b5f8924c53b3b8e207552feadfd51e8fb1dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252393, "uuid": "17c813a3-47df-4780-b25a-16b47a3d062a", "comment": "Malware payload (Mirai)", "value": "08a73e0ca03212fe14696b8416d8711197508b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252393, "uuid": "c47fe650-79f5-422d-9598-370b64c00ffb", "comment": "Malware payload (Mirai)", "value": "0f9bdbfe75efbd16014c2417d98a6c4f288f8ea8e81eb271812fe9b24b7b424e45da80eb146ac4824348423895f645c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252393, "uuid": "065292d3-fba9-46a8-b847-ffdb5663e0c5", "value": "T175D30945FC518F52C6C666BBFF4E428C772607A8D3EE72029E256F6137CB85A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252393, "uuid": "fb0c7799-f5c6-487e-a2f6-77de156b8b66", "value": "3072:ARY4PU+LRN9Qo6ep15nlMZsnIRF7cwEoDsLa4FO5cYi8yL:+Y4PU+FN9Qo6e/5EcoF7cwVDsP85cYiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252393, "uuid": "befdb34d-8174-4708-8e98-5d23db65ff88", "value": 142432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252393, "uuid": "ba0c4517-cb19-4df5-9a32-e8e668a0b8a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252393, "uuid": "70634371-6513-49b8-8881-5ba5065b9a34", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5031d812-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765285777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285777, "uuid": "d42ccbbf-2648-4074-bdb7-a2f1124e91c0", "comment": "Malware payload (VIPKeylogger)", "value": "19d1c4d2fe4818f2123ebabd62aad665", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285777, "uuid": "bd4633da-9783-4602-ae82-f903a7be9983", "comment": "Malware payload (VIPKeylogger)", "value": "369291d0a225ac4683f2a3b01d6643946d3b4e1bf75538ea8896ff38ee2573ce", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285777, "uuid": "5e8fbf5d-068e-4976-8043-b99090eb314c", "comment": "Malware payload (VIPKeylogger)", "value": "a2f5019a14aac2e9a0b248726291409ffe21eb85", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285777, "uuid": "b00fc959-3647-497e-a0a8-fe203508ccff", "comment": "Malware payload (VIPKeylogger)", "value": "be6967889114bcc2d70bf3356675c1337b4036615b9bb7bbedc1202c33dd0757e706e7c955395afc9723cfc3d4aa1667", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285777, "uuid": "052ce67b-3216-48ea-bbac-7d041754e034", "value": "T10D3523B07EE63EAE46BCC73F61694F38AAA02B54845459CF73EEA4C443EE601B44F451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285777, "uuid": "a6befd4e-cdd3-4f7f-aaa5-937d7f89a546", "value": "24576:0TfLi8Lmc5vwgUIoFHEgMadmAIGT+vHKD6kQu8up:0NmcNwg+/mA9+PKOPf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285777, "uuid": "dea4c4b0-69c6-4a36-949f-b7d53e7a28ce", "value": 1089036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285777, "uuid": "47aa63cf-a2d1-4731-a657-31b6d44cc372", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285777, "uuid": "8d236720-b87d-4914-adcb-7cbb54ccbaf7", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d021e5-d514-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765294433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294433, "uuid": "b80bc038-b5a8-439a-a6a9-05651c5e91cc", "comment": "Malware payload (a310Logger)", "value": "b688a44b64ccae2dc53ff4bbe2304522", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294433, "uuid": "4c7c3f55-b8cb-4fed-a19f-6b54391f0ac6", "comment": "Malware payload (a310Logger)", "value": "36a3c500ed0500d0d2c222504cdd3023a4f3b8dabe2a50f45f31908b3a4ddd74", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294433, "uuid": "09ffc480-047f-42fd-a0bd-94e98deb08f4", "comment": "Malware payload (a310Logger)", "value": "0723b422bfaf2e867ce6f48cdbd73c50f063e0bb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294433, "uuid": "798cd5da-4c4b-4124-bf24-5f65933ad403", "comment": "Malware payload (a310Logger)", "value": "d34fd4020026f0df34b43e4daa7cacff05307de81a40f727480c5abe1d8347294eec8271ea44e2ead42f75d070f31d99", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294433, "uuid": "d9818999-ed99-4ada-a352-948373fe0df2", "value": "T1C22501D03B3AB719CE654674D5A8EEB152F61DAD74007AFA59DD3B8731AC2009E0CF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294433, "uuid": "9330a093-34b5-46ea-adca-b4b0869ab19e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294433, "uuid": "9462abdc-c4f8-407e-afae-8e6333c07a3f", "value": "12288:bgcJm86OKAX0rlYJazmd/cmW2fcrRmEmghNJS7fWhTz2ktGFtnjTjyh+3/9xohdk:bgdzrlYJ8mhMsgHJ0OkDnjahEed9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294433, "uuid": "bfd0df2a-3657-460c-bdb8-f688c7639a10", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294433, "uuid": "a9be3402-500c-46c6-b281-3b4f95b56a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294433, "uuid": "1f0f39ae-b080-442d-a40e-0029aa1cac3f", "value": "SPAIN_0RDER_DETAILS.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788bfa32-d520-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299588, "uuid": "dd37099e-9d87-4950-8a54-8b759ebc9faf", "comment": "Malware payload (Mirai)", "value": "ca38ebd576c4ae198ec95c2d041837e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299588, "uuid": "d3f1ba7d-b4a8-4cc8-91c1-ea2f4fedb90d", "comment": "Malware payload (Mirai)", "value": "38b4560f692a917a8da916e8fa7ed141fe38703b3d6f3a614f7b5d2d37c09eda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299588, "uuid": "0110e125-ef7c-486c-9b7f-30a771e535b7", "comment": "Malware payload (Mirai)", "value": "06ab96ff2a9aaffae1266d4bc259e8cbe4fb7567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299588, "uuid": "ad06fe4f-7ebe-4813-91f9-ff5e74742244", "comment": "Malware payload (Mirai)", "value": "994ae260d57bd00e4c6c04ef58aaa55b825bd8338220f65a1310ce2b43b901585ae5849f620863eb8841c5c60c9eed19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299588, "uuid": "5ebfde31-74d4-4c46-950c-e0b3cce54316", "value": "T1E7559E66F2B370BDD017D03047AFCB626935F07911322D7B25C4A6382DA6EA05F1AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299588, "uuid": "a0522771-972e-4e58-8365-4488bff96183", "value": "24576:yWA+t/8ph9xdbqXsq8TwhL+Fe+F4WBlg2zPc:LJ8ph9xd+Xsq8TwhLsTFjDg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299588, "uuid": "d874a878-6052-4557-be93-159fcc9fd30f", "value": 1357432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299588, "uuid": "6a33f4c3-34e5-44bc-a590-bdf7c8d853ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299588, "uuid": "46cdba4f-1a2f-4aab-91ca-9ba1e3075054", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e79048-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765286341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286341, "uuid": "8eca0df3-7d13-483a-8835-f4e9a7ad2917", "comment": "Malware payload (PhantomStealer)", "value": "3ad45cd6974d526fa90a13109a55d850", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286341, "uuid": "21c54ff9-f5cd-452a-b673-fbbda954cb7c", "comment": "Malware payload (PhantomStealer)", "value": "3a3a7bf17331c8f6faa3b0dfb109cda4154f0a999f0b27a293e29439c10a94ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286341, "uuid": "77f8a379-47f2-4aed-b890-b6cd0844001c", "comment": "Malware payload (PhantomStealer)", "value": "8dc144edf85feb5d897a8fe1e90e38768ca805ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286341, "uuid": "4d24a8eb-9b15-4d75-8f96-9491684a1a48", "comment": "Malware payload (PhantomStealer)", "value": "1f0e044b346a47d9e6e3a605a60fc8b6ed11529aad5fb71b622750cbcaf5dd67e2c94d50a5aae6aa84ad276aaaaa1ab8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286341, "uuid": "e32c52c0-e305-48ba-aff7-ccac23c21c67", "value": "T110D3734162C1B8A403971F76771FB8D5FD3F09D93498498BC161FD90B9B5B0AEAE0A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286341, "uuid": "2d836342-60a0-428d-bf57-865fee0ae3bb", "value": "3072:YbBpBN7kiBka+7xrl+NU8HJBeSZ9W2tmkZJCatDo+tvOmenvWMRaAS/UX:YbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286341, "uuid": "930adf6e-bd66-478e-bc8b-ae17002e2b44", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286341, "uuid": "efe6b06b-12cb-4d83-9702-36200ec4341d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286341, "uuid": "9a23e9d7-1eaa-41cd-beed-29cb46b5e0a5", "value": "Paymnet Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677d39c6-d524-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765301278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301278, "uuid": "a4f4373a-9145-4f26-bd94-8c42d31269bd", "comment": "Malware payload (Mirai)", "value": "e284a0ac026c0df68d6586e31020d388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301278, "uuid": "5719dab6-aa70-4593-ae17-c98853256efa", "comment": "Malware payload (Mirai)", "value": "3a79bd0d604993cc0f9405c8df2fceed1e1e6fb921c0841be3472135e02f01d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301278, "uuid": "08bee622-94aa-4d66-a554-07e1b3a56037", "comment": "Malware payload (Mirai)", "value": "aca407d99b6a54d21768b0bb7b11dd2282abf561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301278, "uuid": "d0c06b5d-438c-4d2f-b2c4-0d3c36e81f93", "comment": "Malware payload (Mirai)", "value": "9de08ac5637426c4c9dfa8b68c3d84eba52bc05761d649d40d8593029fbe790009d0884ac568cb724c33530734615a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301278, "uuid": "4b130773-de5f-4092-b3e0-102df4ceb3a7", "value": "T197435A43721C0A17D5A70570193F16E183FBAAA021E4B2C6A81FAB5E4676F37184BFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301278, "uuid": "e7c8a588-367d-4ed6-92fa-d781b7b17895", "value": "1536:nxotg406P2l+MvdpJ9WYTSPPBqlT3bsRk:mPovbJdSPPIlT3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301278, "uuid": "719f1b2c-085e-4dce-9de8-8ce46cab586b", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301278, "uuid": "c4c299a2-6e90-4cbe-8ab0-7cb8fde0772e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301278, "uuid": "e9cee522-84eb-4e63-ac5f-67ef12a28282", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10812a67-d4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Matanbuchus)", "timestamp": 1765266772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266772, "uuid": "61036a94-9aa2-4be2-ab0b-511524d2d0a7", "comment": "Malware payload (Matanbuchus)", "value": "5ba4153a662315289bb6ed526e34e921", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266772, "uuid": "be4e6aec-9cf1-47df-a8b2-5f2d2ee6d4c8", "comment": "Malware payload (Matanbuchus)", "value": "3ac90c071d143c3240974618d395fa3c5228904c8bf0a89a49f8c01cd7777421", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266772, "uuid": "f9320726-ee80-452e-b41c-51f38b1e5a18", "comment": "Malware payload (Matanbuchus)", "value": "d39d5e1f6e1621659cc65f65d317d5dcad356869", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266772, "uuid": "99affb1f-9555-49c8-b8b6-f2317adc4b78", "comment": "Malware payload (Matanbuchus)", "value": "45eb572ece8d6771c90e3ba357fbd74689d9aab55fc3f05e220fadeb5588c3489874442a8f3d1d9bb0f48b1fef909a7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266772, "uuid": "c2e713f5-ae79-4b8a-85f0-0e3cf69a413a", "value": "T1E1E36C12B6A19560D5BE0478A8B1A7798B3F7870CBF159E333841A6B5E206D0CF74B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266772, "uuid": "e279b279-8f01-40f2-a005-29e0f70f718e", "value": "bc4c315873d0b7e201f643ac2730bba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266772, "uuid": "fa75f822-623d-4267-a31a-3b70a97ef5cf", "value": "3072:lkAWsVsT0sR220pCzJAUQE5p4JDkQoLy2TKCwwKa/tpuOxVhN:lzWsVW8pCzj5p4Rjwq+KyNrhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266772, "uuid": "798babd2-8cd9-4bdb-9a37-3fb0ae68dd71", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266772, "uuid": "2d5b6d5b-5b5b-45c0-8f10-c34575f246ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266772, "uuid": "313069ec-c177-43f5-890b-4190e0d62048", "value": "3ac90c071d143c3240974618d395fa3c5228904c8bf0a89a49f8c01cd7777421.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8ca9a6-d500-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286041, "uuid": "b7774984-5f76-442d-82ac-9446bb188cd7", "comment": "Malware payload", "value": "a38677b5c7645200865c4eb78b66b900", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286041, "uuid": "6f022042-fbc1-43a7-b3d0-0fc85ae34fe4", "comment": "Malware payload", "value": "3bb4bdcadd94783497e174bb1a753ac4819721b1f83495c1f4884e202353338c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286041, "uuid": "01a6a289-8006-470b-bc49-197a760668ea", "comment": "Malware payload", "value": "616d37ac8424fc762bc00e578fe66d3e6cbd7832", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286041, "uuid": "79a80e9d-1762-48da-980d-7798d971e8fd", "comment": "Malware payload", "value": "ec5992dd204b094844ebfb5737c294b10ce4eff8166127d1b1f5c8ad414d50deda6201745b8b1d8b4c109836c71711db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286041, "uuid": "2175cefb-39b2-4a7d-aae9-30812fe15a39", "value": "T166A35345A2C0B8A9238B1F76B72FB0E5F93F0C9D7594489BC111FC90A5B5706DAE1E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286041, "uuid": "cd6c9a3a-87d5-43cb-99e9-ef903ec3059d", "value": "1536:MCdKgoXHbCVWDCVxCeAW/tmVcA5cBtogLfj81F0aN3uqT6Qv4Bj:MUZorsWPqFmUrj81Ft+qT6Qv4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286041, "uuid": "d725909c-d2cf-4c4e-b636-de4328d3c4ea", "value": 101705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286041, "uuid": "3d210a15-2113-42bd-9c43-52986745909e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286041, "uuid": "d226994a-f797-457f-8382-662508037f2c", "value": "LETTER OF PROTEST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832f625-d4c5-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765260423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260423, "uuid": "014ad2f7-fa2e-4999-b76b-74429254794e", "comment": "Malware payload (SnakeKeylogger)", "value": "ad0414f7051eb4aa783ad49cf468e0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260423, "uuid": "ce83c3c5-141b-4920-9bed-69dcd11f2c56", "comment": "Malware payload (SnakeKeylogger)", "value": "3d26d15d45309e55871bd2bbfe808557995ad18a94fb08374afc6209710fe1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260423, "uuid": "4aa38ce3-dc6f-4881-a372-48cfe4e21270", "comment": "Malware payload (SnakeKeylogger)", "value": "1a5d13f62ceec04a3a65adfd22250f23a1518da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260423, "uuid": "b1427571-f9fb-42bc-9537-d612574db3cf", "comment": "Malware payload (SnakeKeylogger)", "value": "5b9d14f4e48083ad131b88fd98bd24d0234ae1499c8e5d86d3fee007d5f8280da61061e7508f80dbfb36b32da9a1c3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260423, "uuid": "b64b7010-3949-4faa-a3f2-3d012b199cee", "value": "T1A5C4DFD43A31731ECD628932D568EDB582A52C79B102BAE354DF3B1B759C111DE0CFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260423, "uuid": "50726aab-6d8e-4385-ab30-6258417ae834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260423, "uuid": "5a6a25a0-cbc0-456d-9ca0-88753afa3ffd", "value": "6144:rGvGCWa/FsHhLODBm2HYROQGVUwx89zeAcMAicbQoueDzVzjUKgTKQl+h0BlluWj:i+dOM2HuOf893o/DueD6E0rlVbOjnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765260423, "uuid": "46f3687d-e566-4325-aaf9-66c29caaad71", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765260423, "uuid": "4901c01f-e698-440d-8dd9-5fecd6536242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260423, "uuid": "2f594658-83ae-4d2d-bd0c-a0fe73105242", "value": "VESSEL PARTICULARS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69d4b3a-d4a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765247750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765247750, "uuid": "eb5f667e-208c-455f-a7d6-859e14908867", "comment": "Malware payload", "value": "30d468a059d3b976f152253c7743700f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765247750, "uuid": "249fca09-394a-4c88-b340-491882fb3916", "comment": "Malware payload", "value": "3e4b632cdfbc3d1312d219a8cb1f1d51b02eb9577b77cb7f5b2c2c43bbb0545d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765247750, "uuid": "1567a13a-6630-4145-bdfd-2db1968e8315", "comment": "Malware payload", "value": "5889cb322421e3b3eb5a18e404f75e008320a9b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765247750, "uuid": "ee4a2c8f-8d06-4777-99fa-71f8f1719835", "comment": "Malware payload", "value": "7dfcb4248a38a5a41d1ac5c30ec70e6b8a0a724836cdf4fe3e6cea36e3c4939202b8a2bd78189a5bfd979c9f913e87ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765247750, "uuid": "55844f75-7ac8-4d7c-bad5-c37d3711b6d9", "value": "T114178C8179555290D2CEF274A091AA3EF63D385A4B313FE75AB4859B0C276C033FA7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765247750, "uuid": "67e2cdc6-54cb-4e6c-a03e-fc2af4d3baaa", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765247750, "uuid": "0266beaa-f9e9-472d-a828-0fd4650a0c06", "value": "98304:c3g9cQALFPOwXWWni/fAslWHqBS3oVhpqPZuN8Dckz9tXhGCYUSBNmU9TZ3H+UbR:sgK9LFPFRslWv3uN8cE/UbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765247750, "uuid": "bda70012-ba7b-441b-a631-0f03dad4a439", "value": 19589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765247750, "uuid": "b2bb7adb-71c6-4aed-ab27-aed6dbebea77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765247750, "uuid": "0f827a7c-e987-4e28-85ea-41585c799bc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7493da7a-d517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765295716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "601a5434-c0af-48ea-b04e-d046ebbce802", "comment": "Malware payload", "value": "f47c00905ba0a0e13fe0a0a8d9fa52d7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "0ffd76d8-70da-454c-a1cb-a86a1b228bdb", "comment": "Malware payload", "value": "3f22eb9ba82ea2604936a2a91db2fd56fbac69f7b425f8c752d191517269958b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "c062a890-a82e-4c8d-be35-3633be00add4", "comment": "Malware payload", "value": "538df0238aecd7e6b8d88c6651620bfb58bd6d73", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295716, "uuid": "57965949-1a62-43b8-a1aa-0e8566f711c9", "comment": "Malware payload", "value": "59843abaed1d9000aac73a9aae69c9383e99c0f32f4aa1da7e94ad2342527d72039885a34d17e7502386f3adc563ccb2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "9cb44974-5aef-4ad5-bfff-4bbd3a9060f9", "value": "T12F472326F3896C7FD8F7E3387D3A125214255D258F03E68B7928B33C29B35C55A9A2D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "bb45347d-731b-4836-986c-ea73e183ffa4", "value": "393216:5ALNF6PVsFOH/f9dEJRqFc6X3k7rZ2GeRnKTEHkngm95NtABuaEPKpwK:5ABEP+Of9S6ncZ2ZITTgm/UuarpwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295716, "uuid": "cafc2c80-3010-4928-ba7b-84dc56135b04", "value": 25400944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295716, "uuid": "fe68f33f-6eed-4063-bfa6-e2546c67122f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295716, "uuid": "58725f27-8b00-47ba-8067-e63eee702a45", "value": "certificadodigi.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f45b3c-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287925, "uuid": "3f2179da-dc49-47fc-ad7e-b52cfef9ac29", "comment": "Malware payload (Mirai)", "value": "995866ccf32621df44b57a6e72aa8382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287925, "uuid": "a2927098-ceb5-440f-8e05-7a098b0f0d31", "comment": "Malware payload (Mirai)", "value": "3f279bd6a59e975db164cf5c52b2d4d65be265cf396c0072c41cad8becbc8b8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287925, "uuid": "e9438b5e-ed4d-4d8b-8661-c14b6be343f4", "comment": "Malware payload (Mirai)", "value": "059db8904f493be9a898e41ecf4fddba8d056984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287925, "uuid": "7f777126-4b8e-4e66-b9b6-2f42a813d5c3", "comment": "Malware payload (Mirai)", "value": "7a59ff8db1f2272f07fceebb2271ac8e4894cc5a636ddb88712348b757f37cc7fa35f73d99f6212db23cc62a795f82fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287925, "uuid": "677aca13-9b87-43dc-92e8-f03642e329af", "value": "T12C632A45FC818E02C6D412BBFA6E018D332563ACD2EB32139E116F2577CA92F0E77565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287925, "uuid": "64d72067-cfca-4951-8f54-3e65ed6a2fb3", "value": "1536:0kBMDVYt1nwWQwiF7EuKRNXK+fXRD33XGZcZ89Z4vrrlF9pmsc:6DKrnwnwiFIuKRg+f13HGZcO3UNF9pms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287925, "uuid": "97614562-5a10-455b-aed3-b044dc4ee0df", "value": 71676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287925, "uuid": "5fd2d99e-faae-4c35-bfcb-9e1ae68ce824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287925, "uuid": "f46e71f1-3bf7-40f4-b5f6-d85b4be1e08c", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96a18a7-d4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765285175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285175, "uuid": "b944fcca-4109-4c78-8043-b0259b2eaa8d", "comment": "Malware payload (RemcosRAT)", "value": "35ae922495c21037fd6fc8dfc29c5e0d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285175, "uuid": "55064c20-1edf-4540-a976-97da36355247", "comment": "Malware payload (RemcosRAT)", "value": "3f61a4b0743e17c8cdba55b9fa18612c0682f16e53650cbce76eaba3a367402b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285175, "uuid": "46ffc1dc-b58c-4cf9-9149-04f67d758919", "comment": "Malware payload (RemcosRAT)", "value": "11987b974324850a242f6cf9b0f7b1c1d1e6a796", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285175, "uuid": "c448f33a-1330-4c63-aa8e-3688abbdd7d5", "comment": "Malware payload (RemcosRAT)", "value": "7ca5cf40ce623f3cf024bfd0d37069d17283d63809e3183625e99797633c4a290b098da238b65a1ff6f23aa617170f9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285175, "uuid": "e20896e0-120d-499c-9f88-fa223dec44c0", "value": "T1D1844B20EE34067A0F471BADFD990B62C9FD8609462650F1F6DE070E61065ECE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285175, "uuid": "a591f751-4128-4b35-b224-cc23b95b39fc", "value": "6144:82A6xrpmnDgpHJ5gmBcmWI2mfWq8iDMP4yL96LY9GDYtqMP6I0okE5iUXyFO1Og2:r6DIJ9BEIf1A4lco9qXygd4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285175, "uuid": "463c7238-ebac-4176-b4f6-3fed8fbb7316", "value": 387673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285175, "uuid": "d68ee496-15af-4e09-a9e5-f567b1722036", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285175, "uuid": "01cc8582-34f8-49f1-b137-1d1f76f6b289", "value": "Bestellung Nr. 4500087992.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47afed17-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298218, "uuid": "09feb885-2034-41a5-bb59-ec3565fc2db0", "comment": "Malware payload", "value": "bff7d93660b95d4a0bf32c265d00ff7a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298218, "uuid": "a763d153-f838-4262-b853-d1817d09d05d", "comment": "Malware payload", "value": "4231f94c54d1e3ff8a399a06d06c3a7b685d470924555a3106a4d0d6aa9cf294", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298218, "uuid": "bf497e14-4a02-424c-a45e-640109788d48", "comment": "Malware payload", "value": "fd5114c710daeea68adbdda83d190dd4295c3dd8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298218, "uuid": "5cca56d7-3b31-400c-838b-37961ab2a10c", "comment": "Malware payload", "value": "85336deea8435fe2d812f0fd35e86392dd5ce6e49bb1ba37839737693bc65ec6748abe650929bb7b45429beabec5ca4a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298218, "uuid": "1937fe0e-9472-477a-94a6-f96c25e841d0", "value": "T106B533173BED145FE5535DB25C67EB468888238213A6A5CF5DC2C797010E82BEEFE0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298218, "uuid": "5a51888b-c2d2-43ee-9e83-ce9a88e6ed7b", "value": "49152:Oqq95gXXh1cx6a1iVoVFvSQZHq0xEfVQefx04rs3g9C3N:bq95gnv3+iVobdZNxEVlfi8sl3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298218, "uuid": "41c7df46-a1fa-4b4b-9a3a-0429aeca9b9e", "value": 2387587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298218, "uuid": "b8139d41-ab3b-4727-beb0-8f98559115e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298218, "uuid": "01866a07-64e6-48cd-b12a-c092a9f1a48b", "value": "monstamanaq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd088f31-d556-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765322923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322923, "uuid": "6d0259bd-8c20-4a30-828d-aa5c04cb224e", "comment": "Malware payload (Mirai)", "value": "d6d5a64db967210b1a270555aeb25cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322923, "uuid": "65bf0b15-4971-42ac-9f53-cf853e5ab1f9", "comment": "Malware payload (Mirai)", "value": "426a520b9a04f10800b7271cb300e586d1127708389516ca7a4129f58e16b646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322923, "uuid": "76859fb5-080c-48c1-99d5-681c74db411a", "comment": "Malware payload (Mirai)", "value": "cfbb45828edbdba6d866352819bf0190b171e8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322923, "uuid": "dac60c6d-abea-47fc-a0f0-3abb620d53ca", "comment": "Malware payload (Mirai)", "value": "b4d77c4f667692ed608976bc3fe388fafda1eb6c54044af8cfb10dd986b045d32d8762df567c547d00acb241ab78792d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322923, "uuid": "4c421b1a-e3a7-4150-85bf-7f1c886d065a", "value": "T1FEC37D44F797E1F0DC470A70102EF73BAA319E626230DDA7DBF8BE726D616429416A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322923, "uuid": "aba023cc-561e-46c2-82b5-96f80cb4741a", "value": "1536:e3sf50fUuM95fxrpb5QwbSR5g+tNXqQLUsXoD5H/Uy318XNuGVbDy1pr:d6G9NXSqSLg+tJqQwDn+AmG1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765322923, "uuid": "a0dd934b-e922-4ab1-9035-3c6e4a88475b", "value": 119436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765322923, "uuid": "04decd57-a341-4f7a-a827-2ff00aceb6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322923, "uuid": "c06546e1-28e4-445b-8282-685b5e9b1435", "value": "colonna.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f9a235-d52d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765304998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304998, "uuid": "a8e53c0b-d680-4a65-b2c1-fa504e2d79db", "comment": "Malware payload (Mirai)", "value": "abbc52c175c5b1fcb12235a5ffbe6b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304998, "uuid": "df73443c-7827-4998-9008-94f1bbfcd8b2", "comment": "Malware payload (Mirai)", "value": "42a946158cdafcee373f6858544a245baa444e929ce7ac9a8354ba183d790c74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304998, "uuid": "8289c873-9420-45b3-b8d2-766836e8a8bd", "comment": "Malware payload (Mirai)", "value": "524e513d870edddb5ef05d9be93b79314bb4949b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304998, "uuid": "467b789f-6ab5-4dc9-b1b4-4a400290dba9", "comment": "Malware payload (Mirai)", "value": "aac4cf26a514c8027c88093607ecdc6233105366328da75cfb03c09a2074d3fa1af6642eec1d3c59eaf0e8facabbfe97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304998, "uuid": "2c22c736-8036-4c15-9d3d-26a721f8894d", "value": "T1893318D9A401AD7CFC4AE77FC8120E08B521775560933B3B67ABFD932D722948C56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304998, "uuid": "48ba8f05-73f2-4b91-a828-cb3fe69a3f4f", "value": "1536:YvsT0gsV1EhUGbLU8Be8uxZqOUC/ozlkk+:YvsT0jEGGvUgEw4oJZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304998, "uuid": "c9c1a224-43a3-4fb0-842e-52e25b1f1c1c", "value": 50192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304998, "uuid": "093df417-9bd8-48d0-a8f7-aed836c17f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304998, "uuid": "635ccb6d-515a-487e-a337-4580054faa78", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b7be3c-d508-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765289143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289143, "uuid": "12442129-e4c6-4e0f-96a1-7a52af046e4e", "comment": "Malware payload", "value": "46fd7d3cb576d7611c922c5d2413d065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289143, "uuid": "e07841d2-7fc4-471c-838e-08c473adf0e9", "comment": "Malware payload", "value": "42b71bec256e8344dd8219145d59c8f89b06dae3e4629084f4c7b163b9aa5253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289143, "uuid": "9eb97ad3-b1b6-499d-814e-019ece0921db", "comment": "Malware payload", "value": "fa9ea593b9482f215c4a1f19d0e3631ed672ec16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289143, "uuid": "3c6ef5ef-aa01-4019-bd73-806bcd85595a", "comment": "Malware payload", "value": "e0db954c872c889523f4d8075052708862b38a63ccf4ee453db3c9b9715d2c054d431241a52ae24521e84d596b4ca9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289143, "uuid": "6ef313e5-bc6a-4909-bd87-757b0cc4bdd3", "value": "T1C004944027C078A503471F76B71FB4FAFA2F0DE83449498BE529BC6275E6B06E9D1A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289143, "uuid": "e9d94759-9f02-4dc9-b260-13292925d668", "value": "3072:1QPfS4scdJF+c60LS1K56hnhXvh7hPitg2u6G0Z4r:1QNscJ+9DnZBipux+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289143, "uuid": "a139872c-dcb7-4ff8-bd97-a11a4e5f5204", "value": 178665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289143, "uuid": "c8418268-37fd-4f20-8d8d-ee8782a3c10d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289143, "uuid": "ac03b443-dc2c-4a9a-8c41-d67b35abb77b", "value": "20251208152306.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d76773-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248123, "uuid": "deb5a64e-29f5-4aa6-bde1-490307e31172", "comment": "Malware payload (Mirai)", "value": "64b9faa35916824c05f4c0111887bcf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248123, "uuid": "f14e799e-5f0f-4643-8522-4e5dc4a61244", "comment": "Malware payload (Mirai)", "value": "432420c135f443d59d76544b0d73e8eb530d9eae7648f7e838015fc706b1eb85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248123, "uuid": "c971c3c1-cef8-4277-a080-89f70ddddb31", "comment": "Malware payload (Mirai)", "value": "7c10c51d3a6cb224d805e3083d91edfbc45feb2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248123, "uuid": "d97988fe-f152-40ba-aae2-02fa8b535430", "comment": "Malware payload (Mirai)", "value": "da3c0efab0b6c40c4622f54ac140ece98f3b482f0b9543667c06ea1151617c2f938ab71e3dc9cde7031e5885913caec3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248123, "uuid": "e565d1a8-21f7-4d66-af83-bcb1bc021d5d", "value": "T15A14C80198A0575FDBE39BFAF755B1CE723657981F83330AD31C5AB013C12EA9929287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248123, "uuid": "61cb1ee0-6dbd-4169-ba2c-9d195f1015ff", "value": "3072:VykagYQ9ACfN+MIbkWX4dT6+IYuyrJWtT9raedxGz9KP9LKO4VmNZKh24FCtZp24:VykdxKOam/IACl09MNlqZTmyN4942Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248123, "uuid": "5f20add1-ee2a-49f2-b4d7-905e93e2c638", "value": 208667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248123, "uuid": "cbfde4b0-7cb0-4a02-bd55-2067ebf8fb55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248123, "uuid": "26c117f1-15cc-4404-9b65-595228daac9f", "value": "Demon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38610ed-d492-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765238672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238672, "uuid": "b6c2b183-480d-4d00-bfbc-d6f64e1e72d2", "comment": "Malware payload (CobaltStrike)", "value": "b6b156e89d24f5452137b558d7b74353", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238672, "uuid": "1c79b40f-77b9-4a8a-9fcf-94f27e2e1c47", "comment": "Malware payload (CobaltStrike)", "value": "4376f6c5bd63c9472dc1575b26f70cc2320682a47881e1a9283904bcdec43fd8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238672, "uuid": "1e1948ea-eaa9-44af-a134-4c5392f5cdd6", "comment": "Malware payload (CobaltStrike)", "value": "20694dd4f49b9ccfc79600acde864593ee64a0c1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238672, "uuid": "f916b9ac-9a10-4906-9d3b-e844103fd53d", "comment": "Malware payload (CobaltStrike)", "value": "1a10a5e26f11d4bf973893f1d9aeb3b25df370625941357281012f480d06d50f730ea267a4c69ae201c554adbdb319a0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238672, "uuid": "fedcaeb5-34da-427c-b1c0-a9cfdd179256", "value": "T1BD65704DE2D35148E46E063FF825FE6D0D31BF232824933A39B479DE2932D5089F9A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238672, "uuid": "5e7f806f-05a6-41c4-910a-683c262a84c6", "value": "adaa1dbd9847dd9a0d33b5cbbe49cb31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238672, "uuid": "1e980827-f59a-40c9-b03a-a41f50ffbb66", "value": "12288:7dd+YP80perSIyZikRobqoooodoooooooot:7/u0p0eZZsqoooodoooooooot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765238672, "uuid": "464de904-f77d-4c14-b06d-5c04bf080e86", "value": 1534488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765238672, "uuid": "57c83c59-db7a-49c0-ac40-5b67da76b14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238672, "uuid": "04e2859a-ef3c-425c-8c65-28b6ae682704", "value": "RStone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dde9b6e-d4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765267197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267197, "uuid": "07233301-4130-4e37-9192-87c04379593b", "comment": "Malware payload (NetSupport)", "value": "4d66d0a0e05158f174f6bcd9058b07e9", "object_relation": "md5", "Tag": [ { "name": "bellylok-com", "colour": "#FA2B8D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sounard-com", "colour": "#34F1B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267197, "uuid": "699ac273-23a5-487f-be2e-bbaf90d4dbbe", "comment": "Malware payload (NetSupport)", "value": "43a3298f210e773fc9a3cb53eaa8c9bace537d5604d6eb95a1304db7b41a8631", "object_relation": "sha256", "Tag": [ { "name": "bellylok-com", "colour": "#FA2B8D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sounard-com", "colour": "#34F1B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267197, "uuid": "043fc8d7-0fb2-4e9c-8be2-dd5d316a70a5", "comment": "Malware payload (NetSupport)", "value": "acd04d8cc03d26bcc11c6653e2f2f516648c2403", "object_relation": "sha1", "Tag": [ { "name": "bellylok-com", "colour": "#FA2B8D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sounard-com", "colour": "#34F1B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765267197, "uuid": "273cfa36-083e-4649-8a9d-c7f27d61e055", "comment": "Malware payload (NetSupport)", "value": "ae93d95ab176d286140a4f6fd9150ac7fcb19d53ffaf68daa2b0dc69c6343c3496b0063db70b4c57ecfcfafb776b6fbf", "object_relation": "sha3-384", "Tag": [ { "name": "bellylok-com", "colour": "#FA2B8D", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sounard-com", "colour": "#34F1B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267197, "uuid": "de29c27f-cc73-42c2-8723-c9abaf9314b7", "value": "T1D5A2E130AB7CD256E75C4AF7F2EB6C4D8FF8402857814289E88CF811164BA9B1126279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267197, "uuid": "9e89ef53-527f-447b-b2dc-3fa1c22b865e", "value": "384:HXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NQR:HXKuqXS69Szi/urdMt5lBUeuhJrsRxLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765267197, "uuid": "c261dd55-fe7a-4569-8048-f6318882d020", "value": 22282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765267197, "uuid": "e20fef1a-e373-408f-b816-f48af8e5153f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765267197, "uuid": "48913ff2-718e-40da-8203-215ed7cbb7d0", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40526e3-d534-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765308305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308305, "uuid": "8423a01d-691f-4022-a7c7-3455327b04ff", "comment": "Malware payload (AsyncRAT)", "value": "71aa5d148a66d4fbffe78477b33f8bdd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308305, "uuid": "4a3c6a16-164a-4fcd-a0b9-345ccd5c1baa", "comment": "Malware payload (AsyncRAT)", "value": "44362a49a0d6e65655754c7a20579d65b3c2779795bca0508e5ed290000e2ac3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308305, "uuid": "1fee9124-ec95-450a-99fa-330ca25e3725", "comment": "Malware payload (AsyncRAT)", "value": "49d0d24e944af473e9c30b0568155d458bc37814", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308305, "uuid": "9d73af29-4807-4eed-bdf4-f83837e5c246", "comment": "Malware payload (AsyncRAT)", "value": "e048ca7019e9411ed0600055f8686c208b6c9659a51193195c3f61f9661fd5738b8593f409b7bbb9c04cbcb37975e05b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308305, "uuid": "74fcaef9-6d16-483d-aaeb-162354e1bc59", "value": "T10B019E51520AE2CC07ADA3ADE4B594C54116866F4005E71C82ACF60D89666784FF87BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308305, "uuid": "a11d152c-228a-4596-93e5-956957993f66", "value": "12:+RNVPXsneIR2L9ESQFVD+h2VDY7qak8CNCOCNCuLKGYS1nFX8:+R/PywL9v6N+AtYEVGHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308305, "uuid": "6f365d6f-cd5b-45ba-871a-23571b3c1f9f", "value": 658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308305, "uuid": "f4826c79-774b-4dee-8a74-05725cb8a238", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308305, "uuid": "fc0533c7-1937-4577-bbaf-1fa850d31084", "value": "ps.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120163b0-d521-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299846, "uuid": "7c8dfe9f-3ca6-4897-a1d9-5f43b2817178", "comment": "Malware payload", "value": "0975a639894d00e4d40a55687226c75d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299846, "uuid": "8c5bbb8e-0728-4473-9fad-0b98df0ce285", "comment": "Malware payload", "value": "44d5c56b2500181ce7ab3d249f9b2c99695094daf3e10cd9b4872a2872e8b4a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299846, "uuid": "0fc775b5-de0c-40ce-98a4-f16568d33d51", "comment": "Malware payload", "value": "d7ce9cd21177752f3500390bb4e15ea90ffa0a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299846, "uuid": "54e5985f-5b8e-44d2-8781-314e7ac930ee", "comment": "Malware payload", "value": "378f5afb62394db9ba98d612e185cf505244004a36933c844135f37eac8934ae754935e29bfd21c052c9a7da82ad2f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299846, "uuid": "bf3750b9-6c1c-40f3-b075-a14396ab292e", "value": "T1D893F746FC819B11D5D922BAFE1E518D335357A8E3EF7202DD115F24778A82B0E7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299846, "uuid": "e75e3b65-e284-4be7-a41e-38c7223e97e9", "value": "1536:yhnopxDfe4l2GwFDtGCq6I2DmDJrhdoz07NJyhkSCvh8cNnDlD9ljrixBVIhquTr:19fYGwFDtG3nD80RMWSCvh8cNn1IBVIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299846, "uuid": "2a42f188-24c0-49e0-92b9-25778a9a95d9", "value": 89584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299846, "uuid": "7b5a76f2-3bfc-494b-926c-16443a9f6fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299846, "uuid": "a2590231-db3d-43e4-afb9-c3a4ef1560e0", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961228b8-d4ec-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765277304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277304, "uuid": "79b695e8-9870-4798-9172-8005d7ea6a96", "comment": "Malware payload (RemcosRAT)", "value": "dcc7753321a25d3103af071f73e054f1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277304, "uuid": "41311246-7d7f-4ec2-994e-f8902755f7bb", "comment": "Malware payload (RemcosRAT)", "value": "44df9284884c662416becafad4ab7175d8102274ed16eabab47c1840e1944103", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277304, "uuid": "c0e5c5cb-3a55-4669-9ed8-94d8f0fb791e", "comment": "Malware payload (RemcosRAT)", "value": "141e9cb3ceeba0b31ff8a42545dcc1506c54ebdc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277304, "uuid": "9aed99bb-463a-44d5-9320-72e13252925c", "comment": "Malware payload (RemcosRAT)", "value": "55e5afcc589b8ae103b0d7bba9f64f6e327937ca53b0ce6f3c76d932615619218d4ea07b0ad12984f6a64d7554ed786d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277304, "uuid": "84f7c776-df08-4646-8369-755c1b760230", "value": "T1441523F2F36B09941EB3689A00119DD9065705E233B96EA8C9D383776AED4F05F793B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277304, "uuid": "e2990755-e299-4ae2-8431-3f6610dde5ab", "value": "24576:YmpjIj2pkgI0gt/pgbQ+FP4RPCdgizZaMj9nPlbmrIwe:YGjBb8DZ+14ZCd1PnbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765277304, "uuid": "344186d8-b355-4a83-a1cb-cd1ecf74d017", "value": 905846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765277304, "uuid": "2c11d9b0-748a-4580-a9a6-005e2e0f116b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277304, "uuid": "6928a3b0-b13d-47b0-ab5a-ace8375cfe05", "value": "Shipping Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f35db5-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287907, "uuid": "a14c5352-6289-436f-855a-3f47ca7b4f0e", "comment": "Malware payload (Mirai)", "value": "bbc2f413692660e7d52f4b0c3561b53e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287907, "uuid": "59dc753c-9c89-4cc6-a91f-5449b2ce26a1", "comment": "Malware payload (Mirai)", "value": "458000da7236af3fb85d8ef781843a2252570db93111d55cb8a25be66cc72bf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287907, "uuid": "7de6fde1-06c3-4e4b-ab1e-61d282035fed", "comment": "Malware payload (Mirai)", "value": "848b90c16a4b218adeb65da4ab658eed9800401a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287907, "uuid": "fb4142f9-6c12-47f5-841f-d3ddfcf35454", "comment": "Malware payload (Mirai)", "value": "7d1fff96c8dae5cba6fd0b4cf1845ac343d27191a0e0bc583e7e01be43261a96e53679bf5fa23d0f1f48c269a1f7cdb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287907, "uuid": "0aa384f0-c9c4-41d2-9a9f-5ac85cfed294", "value": "T18413F785BCC2892AC5C413BABA2F11CD331163EAD1DF7343CD155B5576CAA0E4DBBA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287907, "uuid": "002925ec-106d-46d5-ab69-02a16fb42007", "value": "768:EVHYE5DQW5pDcC94MU7UVuptE3tnq49cMKIesofrczKepzp/VBpE4CTJNTE:EVHYEpQcpDL9fU1tE3uMB1irczKe5p/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287907, "uuid": "b4ce4488-5df5-4cce-a16f-a4c302a72c4f", "value": 43024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287907, "uuid": "80adad71-f86f-462e-9bd1-a4c528345eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287907, "uuid": "979dd4a3-ce0a-41e9-8966-747ceab0d826", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23fd833-d556-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765322878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322878, "uuid": "4e38a41b-de33-4f44-8a7c-84c9f4cc2ee9", "comment": "Malware payload", "value": "d501451c9191097516539abe9b66d2a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322878, "uuid": "d72594cd-8b06-45e8-a0f7-68bf7ad09a6a", "comment": "Malware payload", "value": "4625ad40e873c1f27c512848d78492e4f85297b73336d5268f024b409dec7c81", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322878, "uuid": "f6488082-0e3a-48d9-9047-16ff6e9c9a9a", "comment": "Malware payload", "value": "319595bfcc06f03574c55c8782f5318e8090e972", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765322878, "uuid": "d4accb39-5b1d-4aec-bc75-71020cd9955d", "comment": "Malware payload", "value": "cbe2599b652d9890b24f7077f35e2bfd03081dd89f1b6c9b4581140e3822b3781e8693d006354c329912d92f16a4c7b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322878, "uuid": "486e2f0e-4061-4a58-b4a3-e55aa8537df6", "value": "T1CB75235AA7E554B9E0B523B6A1F243436F72F871273846FF22C8D27E19334D1A634B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322878, "uuid": "9e3cba7a-d6f8-41ab-a277-fd11c486a173", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322878, "uuid": "a6561eee-ea1e-452e-921a-85cb4cebef31", "value": "49152:lXr8WkDUmozjFolLvzK/eAN9B/zmYaMjdmsk8iEXF:58WLmozjilHRkr3a6p1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765322878, "uuid": "ec05ee03-614f-4155-9ad8-7284ba996450", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765322878, "uuid": "f002688f-3f57-4886-9ee6-f94425f7830a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765322878, "uuid": "de56bbf7-4fbf-491d-baf0-65c1b483388b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475b2e68-d4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765284903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284903, "uuid": "9c31ac43-787a-4d01-ba96-2d73169c78e0", "comment": "Malware payload (AgentTesla)", "value": "e5c10f5cd387861fb476340dc1bf615a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284903, "uuid": "e174bd85-3f45-47c4-9a7e-7d00aa1e5adc", "comment": "Malware payload (AgentTesla)", "value": "4732dbdc81918a0e27f6d399ab27606f387d5bb9adfee4f409d21f2e087dcc2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284903, "uuid": "e6ea3c3c-a2eb-4606-8aa0-2cb1bea3f3ed", "comment": "Malware payload (AgentTesla)", "value": "50a6023e86dd815ce43d17c455840ba56a3b382a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284903, "uuid": "33ef4340-4315-4442-9510-2068801f1d3d", "comment": "Malware payload (AgentTesla)", "value": "5fb59c4fae8d75684485191471ff46196cd50111304fb6c77252a1694ce0c7ccd1d8080a90b70f7c61128b0b28122509", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284903, "uuid": "9a7272e2-1fec-4650-a58f-214337764def", "value": "T1EEC42328640CA5D86A14E14A7480D4B51F96D73FE7EED88FA702FA334EE73D0A245399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284903, "uuid": "86078590-6ca6-4e56-b816-438c493a7d9e", "value": "12288:K0T6ufgmxwB1C0937cNMSMcgk7ki7DnuSUB4SwH94y05IPI+:Kijxw+y7cSSwk7kEDuSAw2yGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765284903, "uuid": "25e50ec1-ca76-4a54-a653-e4a506c8a508", "value": 587148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765284903, "uuid": "f2461c7e-53fa-40ab-bb26-a8d2c8e0ce89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284903, "uuid": "bdef6f9a-aefd-41e8-8677-a250bd275742", "value": "STATEMENT OCT 25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0fb882-d535-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765308798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308798, "uuid": "f9f0384e-ab8b-42c8-9b81-b35ff9cda73d", "comment": "Malware payload (Mirai)", "value": "19c826cc84bafb8c4b1c2001947f5b1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308798, "uuid": "f11f1b58-6c83-43dd-92f2-32c8b07b0043", "comment": "Malware payload (Mirai)", "value": "48ca23684869debdbba23e5836984cf3e7003677dba6f463a4a55ef71a397954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308798, "uuid": "6c2f24e4-2bf6-4c3d-98c8-90d4ed7dfff4", "comment": "Malware payload (Mirai)", "value": "50a587d9059d356ce8a630573a7bda20ae42e220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308798, "uuid": "b9e3c6fb-d10f-473a-ab38-6c17113e2580", "comment": "Malware payload (Mirai)", "value": "20bb364558b74695b1232c07b1c8b84b24d42fac990044453e0eee6ef0e9d8bae2930c0f830c3bc99b1d8eeaec97ad98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308798, "uuid": "a9c389e4-3b3e-493f-8265-cb64de21e5b3", "value": "T1BF730250C6B04705C9BE81782AC3A52F3624EB4CBA74C6E04FD4E19AF4E9DC7691F6C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308798, "uuid": "f8d500eb-f42a-4764-82f0-079fe18af059", "value": "1536:3l8ejcG1W/uNC5CcmDoMHJgaeAsa1i1vsRruwsiKrubgtX/Hm81nouy8Gyc:maWGo5CrNJgaenYUkugKrubgtX/Hm8tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308798, "uuid": "63d109e2-ad3c-4d6a-b53c-81378ff502ee", "value": 76460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308798, "uuid": "ca7257ce-b47e-49b3-afcc-cef6d995c51c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308798, "uuid": "9c8768e7-29e0-45de-ae83-63c8cb8a5ffa", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663dc607-d493-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765238998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238998, "uuid": "8399f391-7f11-4691-bd30-d2a340ea8afc", "comment": "Malware payload", "value": "549c692c33cb6a454945201809e94ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238998, "uuid": "8bad16fd-2125-4846-9611-5ccf1f1087b4", "comment": "Malware payload", "value": "4b22a5b2837b39dac8e6f53da7c7f5e5a95f991aff5da76dc2c4d9ed06e8d5ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238998, "uuid": "6e5d442d-efce-449b-89dd-5a41dc5b19bd", "comment": "Malware payload", "value": "52c40f0146ca0de20f46c86b2544027b80a6b34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765238998, "uuid": "117e52e0-b1f0-46ff-93ef-2f67e3fff88b", "comment": "Malware payload", "value": "b7fc738a3008e5e341622549e5df9bcedb74e4ea6636f56a8bc90f52b7bf1ae0fb0fe9eaad31d26696b9ab2b944d439d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238998, "uuid": "cb136d99-2002-4f02-8bd5-8f12eec8897a", "value": "T1732412DD8D23A436EE3655F1457BE27BA8DBA0341FF8A3D8401897D4B5C4724123BB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238998, "uuid": "a9436dc3-de3b-4619-86c5-e34927096fdc", "value": "6144:8zDILkz+prrFr+2rx70rQnaDcvsGzNorTEQFf7qKMiD:GILkz+prrFC87A0WGzNocQtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765238998, "uuid": "dbb657e4-30af-4151-b365-8644cbe3e0d7", "value": 220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765238998, "uuid": "4d9779d1-5dc5-4986-89cb-148234e56108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765238998, "uuid": "aff3e75e-f8c8-4273-9d09-080a8059c5c8", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a70f6c8-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307779, "uuid": "b73eb11f-d80c-4b2d-a9cb-b4faacc3ec7a", "comment": "Malware payload (Mirai)", "value": "70d312af50d8fa82ecdba9512d657ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307779, "uuid": "01394549-98b8-4bd7-be52-bb05fcb54671", "comment": "Malware payload (Mirai)", "value": "4b8887434743d43ace1779e3381775faa8e3a89241422fe26fc5c4105ada7b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307779, "uuid": "1067b195-26b8-4a1e-a21b-93d7969bb12e", "comment": "Malware payload (Mirai)", "value": "649842bbe424d68ebed234eaf85e692a5e9efe05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307779, "uuid": "9d843bd7-de17-4b44-8a9b-d4f207d3d94c", "comment": "Malware payload (Mirai)", "value": "9d241b761a68980459a364ac3cf37cb8e0478cab82162ab0ae6ef63e7956bbe1f8ad4690e401e6ba58c6c63890bf15fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307779, "uuid": "f26a1be0-4eed-4d09-b1aa-6a2108749b10", "value": "T122346B02B72C4903D2D61EF03B3F57E153EFD9C221E4B541299F9A1A927AE331849EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307779, "uuid": "f1883d6e-426c-4ee7-8f73-a5f2af64b0f1", "value": "3072:ntSgrh4EDYw1Wu33Wg/6SnLZyE1bQm5Gvxc6oGgOCkFuh1Owd1Exbm:tS/EGg/6SthQkGvxc6oGnCkQhEiybm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307779, "uuid": "e7f69fc0-6d65-4090-93c7-1d82fe9e22d0", "value": 249732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307779, "uuid": "0b9af765-67d1-4e20-80f7-7f4d14cd2990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307779, "uuid": "93b8b6ca-1153-4428-894c-1ac3ca28d112", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476f8018-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287909, "uuid": "2e4d9923-2c92-4da7-9225-5e2c50a95e38", "comment": "Malware payload (Mirai)", "value": "0fa417774e1882b2d4dfef8c6d0ff234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287909, "uuid": "389c5565-1485-4a17-ba63-9201005031fb", "comment": "Malware payload (Mirai)", "value": "4c43b35915625062d50ca40187a16a0a4663a25b1aece67eb9ccf7dc7cfe84db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287909, "uuid": "88965d25-8fa3-4b5a-8133-1b440b2caf1e", "comment": "Malware payload (Mirai)", "value": "78200bd0d1113e6a68704f7dc856711c542b2c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287909, "uuid": "774b60fd-fb42-4308-936f-4c1b5703a51f", "comment": "Malware payload (Mirai)", "value": "15b1b38df043386ec66e6a397f2ee8beba64a86fdb10998c3b9de9a12a296b22eb187e86f4ddd28100474c0c7d19005a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287909, "uuid": "2dff3a0c-ad17-4b1e-a241-d01aa20da3f8", "value": "T17353F755F881DA06C6E513B7BA3E018D332663A8D2DBB2039D196F1177CAC2F0D7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287909, "uuid": "229c682d-9dd7-4456-90a8-3be3a142c1e9", "value": "1536:HEuQbCEXeshQ0u2MuKRWLs2bebUZZ4abkFdpvmW:VQ3OsW0uJuKRes2bewDJoFdpvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287909, "uuid": "5b238799-3c8a-476c-804d-8370ca2b7c2a", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287909, "uuid": "326bf9d8-15b4-40c9-8ecb-ea10ea24f4ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287909, "uuid": "a25cd2a2-052a-428b-b09e-a4dd7a9bbe81", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ca7061-d552-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765321037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321037, "uuid": "ef929d4f-005f-4641-aca5-c4100a7213c3", "comment": "Malware payload (Mirai)", "value": "86da900e8b3021885bd14d51674bbfc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321037, "uuid": "54eaedea-7535-482a-b446-fca59b207d8c", "comment": "Malware payload (Mirai)", "value": "4cea9d9c8283268bade866258e88379cbecc3a1a1481cb276a145d59211c8fee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321037, "uuid": "c650e3a8-12a0-4dc8-82c5-190e9fd65cee", "comment": "Malware payload (Mirai)", "value": "32a981508ca4a07a8d35718aa946aed922424961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321037, "uuid": "7c79f1a8-07ef-4b5e-bdc8-0d8f3ea56059", "comment": "Malware payload (Mirai)", "value": "36b6532832393fae6fc6c4b717a1ce5f86946a381feb3da675bd6a810ed565579eda0075e0ff692a21d2865426adf1c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321037, "uuid": "58bac762-0f94-47c2-8fe7-b54dab4e17f9", "value": "T1C8D32882FC919A2AC6C317B6FA6F524D332167F9D3EA7213CC180B657AC950B0C67B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321037, "uuid": "ffa5c398-a81c-4deb-989a-50877b554140", "value": "3072:NDJGUBOH2qfYWEcLrV5wO+lmXMNTdsd3T:rGUBOH2qQWrV52qMNTdsd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765321037, "uuid": "ba7c74a0-2168-493d-b744-5165566b6189", "value": 142116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765321037, "uuid": "deecbc7f-a295-43e9-8158-5e1bf693b5f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321037, "uuid": "4dd24f3b-597c-4221-8a8e-d51d395ade4d", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad3dfcd-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252455, "uuid": "f14fee76-416f-42fe-a3ef-bcce3c4d36aa", "comment": "Malware payload (Mirai)", "value": "7770b28c38e25881539c14071474a663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252455, "uuid": "2bafa25f-6d6e-4f71-a7f9-791d54d5a4fb", "comment": "Malware payload (Mirai)", "value": "4d251791210b2201c6d9f59b054e51cb73ca798ef67b446d94588313641abea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252455, "uuid": "d145c35f-1352-483d-b47b-6209c0b3a798", "comment": "Malware payload (Mirai)", "value": "c0258af301a0f9fac0472587fac8a7d81dfb7956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252455, "uuid": "d0f638aa-c87a-4161-bcba-701b24a4300b", "comment": "Malware payload (Mirai)", "value": "3a8710f985ab0bc46a5b0e62bec10dab08bcdec2ce589900c109abde081786078bf28cd08a68a97696f309e54e2b1dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252455, "uuid": "9ddc212c-63a7-41ee-980c-a03c9991cca7", "value": "T153F319C7F900DEBAF81EE33748530809B130B7A254925A737267353BED7A199057BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252455, "uuid": "b6cca975-821b-4242-9b04-3c66a1fb793e", "value": "3072:sGVthoC4tFsrAnz+uh02bWyTkJYdA7epE/vJ59B3Vxjbi1LO+4KKwguU2B1:RDorz+YKyTOYdgeSf9BiLODOU21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252455, "uuid": "f7f6444b-48e0-4b15-85b3-670530e289ef", "value": 169420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252455, "uuid": "bdfff59b-09c5-44d9-8b4c-085e3accc457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252455, "uuid": "a65c9a81-5c95-493c-bd01-ead1c640f1dc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f14f18a-d4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1765272004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272004, "uuid": "53eb42d1-9d8f-4a36-888a-b24b8391bad4", "comment": "Malware payload (DBatLoader)", "value": "df693849e53bf50d5049174fcc970a31", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272004, "uuid": "f8d1b3a5-61cd-4e98-a383-80a9585a7cbd", "comment": "Malware payload (DBatLoader)", "value": "4db715887ac351e20fae615c54223b6eeb9817036e9c62b428b6659132a70db7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272004, "uuid": "34fc86cd-733d-47a1-8024-ec01d52df758", "comment": "Malware payload (DBatLoader)", "value": "cb9dda976b5412d491fd068508ca095602532e9d", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272004, "uuid": "0c7c678f-624d-40c9-ac34-1f05f8a87738", "comment": "Malware payload (DBatLoader)", "value": "7d00f69def6b4c461854db65753b960912d051289fee2a7fa3bc9200e54999246f387a3dfb8f9b85e65e4db3ca4e9990", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272004, "uuid": "b3d5b02c-dec2-411f-aa4a-89ee3f937548", "value": "T1AA85BE1BD890FFE3D12D0934584A925660E63D702EEB981D2ED5394A37FF7C1702AE92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272004, "uuid": "fa78f3dd-1f4b-49f0-906c-0d844498c3f5", "value": "66c0990c43c2cc8bd89ece081656257f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272004, "uuid": "17675e27-4c05-4304-854c-83a656836a6f", "value": "24576:g8MYpJbpfCqK1jKUoFjmqKjqDrpVREuy0nyn6f4mZq9afEfUYwK:g8jbVQmFjmqSqXp3Edn6gmQacfZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272004, "uuid": "206501cc-fe3e-464c-8ef6-308985a4fbc3", "value": 1751040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272004, "uuid": "f379fd36-1b4f-4808-b75a-1d435363d6da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272004, "uuid": "165a15fe-62d0-4b6c-b3a9-4215c8366d00", "value": "Adobe_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3ee165-d4d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765268780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268780, "uuid": "3e04b16d-8e82-4153-8eb9-91fae03d5665", "comment": "Malware payload", "value": "9297dd424d3cb4f62357892f13a144d1", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268780, "uuid": "29de1966-5928-4049-993d-eb3ee09d9faf", "comment": "Malware payload", "value": "4e806d94ee7e7340fd0e0f8bb43dd96b0d738b08f17a1ba9e12b296f5006fb18", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268780, "uuid": "539836a2-2ad6-46fd-bf26-b189e4fa94b1", "comment": "Malware payload", "value": "db363955302b2e3199bc59f76d10813d2c7c393b", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268780, "uuid": "54858d9c-16df-4e1c-b68d-6c8d2be65646", "comment": "Malware payload", "value": "c68a3e5cfbe6177aa9ab001656a1cffc026dffb97f63a2d89da8eb1753d602af78595ad318efa70c24e0652c5f9e806b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268780, "uuid": "16911c4e-73cf-43a5-940f-4a2bc85d6a10", "value": "T1BB2523771AD27E7CD18C84FB501731F3769C4C41A8713944A26B26CD2D968BE8228AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268780, "uuid": "9f1e14f7-ba6d-4a66-8804-3f1ec97ace43", "value": "24576:t2gdrFt1T06FWsn1vybtfcGQqGgivJO0b+vNdYJ:5xtisn1+rK+vNd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268780, "uuid": "5ff3aa6f-fa80-410d-86b7-1e87aa562952", "value": 1008207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268780, "uuid": "0ee7c32a-1ac5-4d1d-b577-bd7c9a45b348", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268780, "uuid": "0b7443df-c0c0-4d9b-a5e8-922be49b722b", "value": "Shipping Doc.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99218b61-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264424, "uuid": "3550260d-49f5-4aa4-aa40-7b713017005b", "comment": "Malware payload (Mirai)", "value": "11b7f9c008f11001f367aa7d8660b5f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264424, "uuid": "c3911cd6-c7c9-4be3-9ce7-01e62ab241e6", "comment": "Malware payload (Mirai)", "value": "5178dfd3285e0ecd43574ba0e58dfb83a71835c897c482d32f2db5ea1c0dbe68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264424, "uuid": "04d15773-1d9f-4795-a467-776c6e5c8d32", "comment": "Malware payload (Mirai)", "value": "42ca54a8e963458f30b4bb3c57f49a4242212db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264424, "uuid": "89e832f9-fa35-4657-b1c5-32590063610f", "comment": "Malware payload (Mirai)", "value": "f6e17c1b661fd04e86fadee0385c0dc11b8e5dbe1e608f30ac6ff27d3cdb12ff6d5c11169e310ecc3eea96adaf28ebe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264424, "uuid": "f63fbf03-f63a-4ae4-94c4-e9d0d26d3585", "value": "T1FC057D8DF7C3D6F2F29341B1014EC7F20574A11AE463FAF2EB452A6674B27921E1622D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264424, "uuid": "c11d5141-8849-48ac-a2b0-6ebd5306dbdd", "value": "24576:VMhCjoRZlhIOhv4gx2/N02id2spU6k8p2Yjp:RjoDlhIOhvlOKq+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264424, "uuid": "3c66e9e9-3358-4948-93a5-bdd98c479368", "value": 838436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264424, "uuid": "500f90f3-c256-4f94-a15f-cd2ca13b7d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264424, "uuid": "34c08cc7-a674-48a1-bcd5-454ac53648b9", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599f72ec-d535-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765308556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308556, "uuid": "7cbc90c1-0ea1-4dba-989e-d29f345e14d1", "comment": "Malware payload (Mirai)", "value": "41df4ae16247b45d4bf670d8dfd27c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308556, "uuid": "bfca0e81-fa9c-4846-8b82-55de046f4022", "comment": "Malware payload (Mirai)", "value": "518236f7a7423420b19adcd4199f42865ba9b35ba48fe1a9a2a5eaa71576a5a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308556, "uuid": "0bd3e335-f0da-49ee-bb94-da6267943c87", "comment": "Malware payload (Mirai)", "value": "1a6c0d39aa109469d69bf14d1dd756f8e9f2c363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308556, "uuid": "8c7b9d04-f42f-4d40-b01b-4481cf89795a", "comment": "Malware payload (Mirai)", "value": "da6063b270ebb91eb664f6e9e05cd08808efe938daefab5148723eb178a13a5c1d5ee2d664a5ce15a62150116faa306c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308556, "uuid": "75ad27bd-dc59-4a7f-b999-25d08b876e91", "value": "T178443A46F8819F21D5C416BAFE1E014E332717B8E1DE72128E245FB47ACB86B0E77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308556, "uuid": "1d1ad1fd-b859-4ef6-a2b1-e54535f2384b", "value": "6144:LF+r+TFRM8lYw3hr0ZS341GszqJIHWdkrSxA/+2rC+ZnTBjLXtKP7a9+DGaRLHf8:LFjTFRMtw3hr0ZS341GszqJIHWdkrSxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308556, "uuid": "01c5aef8-78bd-4f30-aca7-3ba0f54cdb01", "value": 261308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308556, "uuid": "27cd08c2-245c-418b-8bef-96849ad6e21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308556, "uuid": "5d9d97a9-4070-44ad-9669-075ea60ef92a", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd003a1-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765279089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279089, "uuid": "dba10992-b866-40a3-b4fe-4487d3398726", "comment": "Malware payload (VShell)", "value": "5dd5ccf1b9e9f194ac18a64bb549d79e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279089, "uuid": "f658ef95-7651-4278-afc4-af6f6f083f0a", "comment": "Malware payload (VShell)", "value": "5212093ae6434bc77f4d3b00ef19a12cb746ea45248b65d0e6ebc6e020d95ec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279089, "uuid": "18affb85-bf71-45d9-8bd3-5b43e7ff79fd", "comment": "Malware payload (VShell)", "value": "7677b402fcb40e899a54ac6e4202c9d0900cb00d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279089, "uuid": "8272de9a-0e3d-48ab-a5fd-6687dba6a00c", "comment": "Malware payload (VShell)", "value": "c82989d1c563a7b79790f3a3929f9106d813225ba6519501f04f7c70bbb487a2141cfbad29e6745dbc3bf5479f5b2425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279089, "uuid": "71d3680a-6159-4291-9127-f9cad7c058d3", "value": "T1EF76F750FECB50B6E8031D3145ABA27F26315D098F24EBD3EA547F1AF93B6A2183251D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279089, "uuid": "4d60fcc5-0150-43b3-8a3b-50eacf2a2ef5", "value": "98304:4Z6PucVILfv25pNBUNried1jm4+2uTMJhw+K:57tKxUMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279089, "uuid": "3ad29aac-b379-4209-8d61-0a8eb1ff9368", "value": 7471104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279089, "uuid": "bd288320-e191-4a50-bd69-27805ef43dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279089, "uuid": "6c64de0a-554f-4fe0-b05f-3884c25bb372", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85550a84-d524-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765301328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301328, "uuid": "bfdd4b70-58cf-40a1-bf35-ca79de63fcf4", "comment": "Malware payload", "value": "9de7f7d7aa354a3378404b12f0626c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301328, "uuid": "02defe55-0e47-454c-a1d5-00c4720db083", "comment": "Malware payload", "value": "52ab9768aeed9e5e99636cdc61be377566a8489897724228a21cd057f1c65147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301328, "uuid": "ea87f2cc-b91b-4ff7-beb9-598e306f0535", "comment": "Malware payload", "value": "a5539c2c54d15e1e80a37a0c94a4c31aaf65531d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301328, "uuid": "083b6291-79d5-4429-98a4-4ac3340c12c3", "comment": "Malware payload", "value": "92c83d808fd8abe3beb6ec72c9ba455c2078c8bfbbf2be6745c93b384744d187dee0be8ac555f501152916a3c1d223b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301328, "uuid": "f84c177f-1c0d-494b-8468-694aae7771c5", "value": "T19755021276C28072E57315320A78D7625A3DF8210F259AEB23E8566DDE342C1DF36FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301328, "uuid": "fc266ab8-f3d3-44e3-af0e-43c1cf4df890", "value": "b1cd9c681988cb14cae0acea8c9b23e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301328, "uuid": "bfa3b88c-0a3a-4b36-bdd7-ffea1cc43d9c", "value": "24576:TAP5m2rLRY88OIicgcK57dqSBLq53k1rYDiQeCUbrlgfvR58/vKmaRkunsbAnEo6:6mGdYfha7d5L43ArYDKbrlgfvR5AK1fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301328, "uuid": "c1db45f6-00e0-4843-ac18-5011991a9f42", "value": 1359384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301328, "uuid": "91f91e62-811e-4429-9901-9eba75a905ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301328, "uuid": "a11e5241-00c2-4d0a-94f2-04040b932dbc", "value": "MSTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaad1bf2-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765286465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286465, "uuid": "95ebfb98-98e5-4a7e-8ffd-03f6f2f04e14", "comment": "Malware payload (XWorm)", "value": "eec684a2d11bd64624ea01cf09e2e8f2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286465, "uuid": "3af3f0cb-3d6c-475e-8139-08d55f56e3c7", "comment": "Malware payload (XWorm)", "value": "5368ee78ec544ea4b93c7e7cf85ca44329b2f3931d8f93194be18866052c5731", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286465, "uuid": "dfb03f13-f5f0-4b8d-8e3c-e9b0ac5d7fb7", "comment": "Malware payload (XWorm)", "value": "5c01fc622dedb354b0de51b473c7c222cacceb04", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286465, "uuid": "cca325c2-74d5-4231-bbf2-2ea0855d7a23", "comment": "Malware payload (XWorm)", "value": "c89a5513fe630f16bc5efed58d8a1bcb90472869f5810215a9be29039fc15c93300d0340ef03022b179339c2f3afbe1d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286465, "uuid": "54ba29d2-a72d-49d3-bd3d-02b37499c200", "value": "T13262343BD65CEFF00B3E21F4118B7D1121619326A8368D6D98D6C199BF2AB114F678EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286465, "uuid": "ea7ff7dd-95ee-4287-b82c-c7057983d03c", "value": "384:WHUlLpOh5ZcxRpUzEuo4/g2Oehfq2ze//vlsQnp89ZuY1wMFZ6w+wBDSh:Pl9c4xOHoOg2Oe5Qhp8ruY1hZ60gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286465, "uuid": "efbd4d73-720d-4308-b83f-f66a6cfd2513", "value": 15752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286465, "uuid": "b16cf799-6df7-4d9f-b837-1af5a6afb32c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286465, "uuid": "4d62b81b-c2a3-4d52-9cdb-b649c8aae95c", "value": "Pago-10663.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb3fce9-d52b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765304296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304296, "uuid": "4f9958fb-6525-415d-be68-54f35a94420c", "comment": "Malware payload", "value": "c98250744b7fe7f9671d9ec0269f00ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304296, "uuid": "5d751b3c-92ba-4c9d-a3bc-271b1b965fe1", "comment": "Malware payload", "value": "542209d9c009a54002018d82c5d208dddea710e69cb95ba746ccd481c73636de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304296, "uuid": "3345f102-c885-4492-a044-995cabc820ee", "comment": "Malware payload", "value": "41deeed0c3806b213e277a8e7e143da8d00e2c80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304296, "uuid": "63f96948-2df6-42be-ab9b-35e4eb969b44", "comment": "Malware payload", "value": "7529ff17714a6aab12a8c99b188df0b4df0daa86e9d8663bc5742e117d65a8266c41dd29c1c63e497cb4324a182e49de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304296, "uuid": "6a0d372a-d962-4950-b759-cc47884e2108", "value": "T11B93844E48DB04A01AA33C61C7DF8127BF78A1434268D6A4FA9CD7A1AF5C9E490F73D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304296, "uuid": "d1d612c8-f25b-40c4-8413-870aca674660", "value": "768:M9CDIiqk+fG/r3JgkRUuPMHGXQm/5DuVQC7OuNQeorCFSgBIXSa23v2Hd6HSx9iP:Pqk+gVVOtPNQTCggBIqV7HQbVS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304296, "uuid": "2ea1192a-cb03-44e2-8c7a-10d262e4e46e", "value": 94292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304296, "uuid": "46fcc45f-a2c6-4aae-8eb3-b983d37c2e0a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304296, "uuid": "6839d84d-2bc7-41e7-8ff4-6045b5aa4176", "value": "Winter_Report_Archive_377.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3b9724-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765286332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286332, "uuid": "dcf01a3a-225e-4e13-8851-48e34040143f", "comment": "Malware payload (PureLogsStealer)", "value": "13b35ae2af90b9e1434f6f375b9c9763", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286332, "uuid": "ffee7157-42f5-471f-9b1a-6e140fb40b11", "comment": "Malware payload (PureLogsStealer)", "value": "55acd054d1a0c8872b1065f6d13c48c3083f1fbc88062812a6ad0520b3f732fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286332, "uuid": "1326341d-37c9-4cbf-9289-7de77e110f26", "comment": "Malware payload (PureLogsStealer)", "value": "dc2313467958c287d2d2a0515daab373a29e7025", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286332, "uuid": "ce2073bb-30c0-4b71-9c08-007b1872a4e1", "comment": "Malware payload (PureLogsStealer)", "value": "ca9020f108b4fb4135e4ef95334a5d6c8e3682e30a75fd5638bd36ea72f7ebdf2839485058743d34562fa64c267a605c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286332, "uuid": "fbd05ba1-5e68-4f40-93cb-eed7eab54b7d", "value": "T18016531237CF10E1DF11A8EADD99599D928D964AC803C2787001E4CCBA9FFB69FB1D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286332, "uuid": "dc9417d6-e55e-411b-b09c-7f339f4443ea", "value": "96:0Lr+iKEVclaSYREf/FUzj+RysCWgqzO5fAJP0hRfLmiT3fcaQ26XyFDEjOJDm56g:lNbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286332, "uuid": "bb2bc4e6-ec56-4a4d-b915-78c5917726fe", "value": 4255965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286332, "uuid": "bf458317-4bec-4f2c-b9d5-583534f1da6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286332, "uuid": "49ed6257-65d1-41b7-abc5-04d642337117", "value": "LIST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07be4ed8-d52c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765304553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304553, "uuid": "470fb467-a955-4cd2-9236-e4fdfa681a75", "comment": "Malware payload", "value": "0c80a9342888dc01ea3b4ea1cf34db1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304553, "uuid": "b5e8e60a-cec1-49ac-8640-464bcc7789bf", "comment": "Malware payload", "value": "565e5bdbfce70fef4d4c189ed189d8157a51bb62a76c5081dca4ff8d470cb562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304553, "uuid": "5fcb2fc5-4202-49fc-84bb-3033eb749cc3", "comment": "Malware payload", "value": "8293ff4dbacbbb44e6222f0ed30086265e9ff0f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304553, "uuid": "d747df83-9018-4125-81ce-643c4f644287", "comment": "Malware payload", "value": "bf6be29bb434e07f9bae022a02cac9bffa23db85b234bc3581106801797f344ae8030cea1ed1c86a675b801814f30df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304553, "uuid": "e896eb76-4f58-4a33-b390-77d4ff177314", "value": "T18783D809BB654FF7DC5FCC3B45B95B04249C960A21A83B767930E818F25F24F5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304553, "uuid": "812682f1-8a62-4d86-bcb9-b771589ed595", "value": "1536:0AN1TIGKS/wMvhmiAAr4n9Ieukd/gFJFcd5Bfruh3oT3bsRP:0ISGKSwzIodJWoT3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304553, "uuid": "3abae618-7d4e-4919-96ba-ec8d1f4500e0", "value": 88392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304553, "uuid": "f4779b48-f9db-4e57-98ed-f9c71ccf5663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304553, "uuid": "7c2d3d6d-63dc-4cd1-9da6-0af276f3e785", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2029996-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765286853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286853, "uuid": "7e217e5b-ce41-41a5-944f-23f8967de5f0", "comment": "Malware payload (SnakeKeylogger)", "value": "52cbc5897fd0312478c0ee1e2977f2e3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286853, "uuid": "fb1b3604-9514-458a-bb09-a9b5983fa71d", "comment": "Malware payload (SnakeKeylogger)", "value": "56f8a2584a0438ff19f7ca253aa8555173c1e3ddf0d29259400bfcd0f69b9bbd", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286853, "uuid": "bc085de9-a224-43d6-b07d-64729d368fdd", "comment": "Malware payload (SnakeKeylogger)", "value": "7ff9db17bb350d9372b00488a0a4a4428e98a07a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286853, "uuid": "caed36b2-050f-4e3a-b021-9cf5874f4375", "comment": "Malware payload (SnakeKeylogger)", "value": "ac332203c0f5f4d194567b09672bb3fbac372ea6c83d65575d2eb04e4d3b9245c4ae819bc403bf49168b4f912eba3f88", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286853, "uuid": "d73b193f-4146-44b0-a366-e8fe1b9bc35f", "value": "T1D295EB0EAB6E9C813BC811A95BFF73C3033335124AB4F196DB3805C61F6BA059995DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286853, "uuid": "8152693b-91a9-465d-8d1c-6d33c02bf62a", "value": "96:DfEtZwJOWv6wZz6o+xKmy/vpTQqmZobu4/0UG+JujSwhKS9/vmsWqm9bu4p96G6f:ZvXAKZdxU7664fqI8JUI6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286853, "uuid": "f2e0fb7e-71a9-4b09-8730-904677b7f6fa", "value": 1947510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286853, "uuid": "cd0d882c-bf4b-4e35-a802-d6bafa93aa2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286853, "uuid": "4235cf4c-5e6a-49e0-9965-bc6f9ab10e49", "value": "SSDDBB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7a0b79-d552-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765321254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321254, "uuid": "9f690e11-e9c0-42d9-ad01-698574b2c121", "comment": "Malware payload (Mirai)", "value": "2c1dee0c9ee758767a068ec4e75ba4d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321254, "uuid": "dcfddc61-d229-4275-aea3-4be4fcfa8ec7", "comment": "Malware payload (Mirai)", "value": "57ed5fe7d8876dfedb5dc85187d22171cf410702cfd0f84eba982a8bb7d8fbcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321254, "uuid": "2e511912-4dec-4363-9b65-7fb5ba0cd672", "comment": "Malware payload (Mirai)", "value": "4c4cbee8152bf466c5c770f235184acaccf0dabd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321254, "uuid": "6a1dad88-33b3-42ca-960a-12d1d604a0f5", "comment": "Malware payload (Mirai)", "value": "7ec8a5afb1af9b852bb05597dae5f92e6780008dcd43c4ee8cc727325409cd3cb384fcae6a69cfed160685d61e8694a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321254, "uuid": "659c1ef6-cbad-4c0b-8f7e-ddc12d061692", "value": "T12183022352D4E82CF9368A75251E9690FB5BA42D865C5F8F52E4CBCCA93BCC34702F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321254, "uuid": "91bcb902-662c-42d0-b3f5-3afe34b6818e", "value": "1536:PS1wI94hsEQAHSMRoW4dpsbncBjNMCFmegKGLuiMGq3azYyl5nDTL+x3la58em0:PCOyxWesbncICJGLuiMGCa8yLL+xzx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765321254, "uuid": "504a4ddc-ec9c-4b0f-86f3-a66101c60d16", "value": 86148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765321254, "uuid": "743348f9-8f65-41a0-b385-c47ae672e9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321254, "uuid": "2367d5e2-b9a5-4978-9de0-1dc00e091cfb", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadac798-d53b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765311350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311350, "uuid": "cc48c6e6-ecb8-43f2-8d2c-2268ab297aa3", "comment": "Malware payload", "value": "537aa066a497005e6a0b116a58b91097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311350, "uuid": "759f7274-cd56-4e5b-b63e-cf39f97ab617", "comment": "Malware payload", "value": "5834d20cfc80f6fe20514b7a1e3e9764765aa3f548e2874504e9d26345f80560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311350, "uuid": "840ae024-9648-4f8d-96b3-ee9a20162eb4", "comment": "Malware payload", "value": "efddcaf39f7d594fec890fa16ac1bdad861a20ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311350, "uuid": "033bdcb9-1f4a-4575-9aca-2a8b47637d38", "comment": "Malware payload", "value": "25f92315be83169fcfec4647d9f7c8a961238d0aef78ad04ff348467c7af234ea2179ccb1fdab373aeeae531cc87b717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311350, "uuid": "1c537593-e2c8-4b28-8515-688e7250d393", "value": "T118D62327B24D773EE4BE16354972AA44543FBE60A41A8CB396F41D8CDE3E4601D3EE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311350, "uuid": "682eb3cc-b105-47ee-a52b-71b3f2211c7e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311350, "uuid": "4da5637c-3252-4531-99ce-728331543c36", "value": "196608:EDbhYeaCneKyk6caXYbca6oV0wsEp+Ra/4Ky3ylp1h9DCrtwW84PdjOPCrNn:EDm3sBkcpHLmws3IBX1hVC9FOarNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765311350, "uuid": "52b6f385-7cbe-402c-9575-7b6754384611", "value": 13094664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765311350, "uuid": "704b5513-5d63-4b11-bca5-15f840994086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311350, "uuid": "2d0ab00d-9f88-40bd-bb35-d7687546c397", "value": "537aa066a497005e6a0b116a58b91097.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc0297-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765286325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286325, "uuid": "6af1f487-a6ad-4153-a28a-39d591a4a786", "comment": "Malware payload (PureLogsStealer)", "value": "887f174dc41453bd575cc4bfd2625340", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286325, "uuid": "d3748280-f0ba-4d35-8a44-b07240478a2e", "comment": "Malware payload (PureLogsStealer)", "value": "58a2e12b712f7f15735e76be17a67c723e50f45f270f23fff2e2d3bd4bab9dcb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286325, "uuid": "e12c202d-8f72-4cd9-994a-6793b171aa2c", "comment": "Malware payload (PureLogsStealer)", "value": "144145d5b150908ebb3d0c48c741d5d4230e1b2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286325, "uuid": "8982b8ed-72a9-4fe3-b539-8f92c504a726", "comment": "Malware payload (PureLogsStealer)", "value": "7954eb31d3fbb54e00688ba64c9e21b4dd2e6d26faab610e95b185506bcc6e4727d79ea361c63cb3e42125bf93d9fd75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286325, "uuid": "086c13d3-a31b-42f8-a46b-9296987273f4", "value": "T1102622785AFCD783E82FA6D82AA4114F3708A9651B5B844F3C62499CFF1D30426FBD25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286325, "uuid": "1fcef902-7182-4aa8-91dd-d56cf193f065", "value": "192:mUaUznwvyVpUqBAgx+O+UNZURIh+hx5nc7PyUtcUOcyA5g/tKYrqJ5cc1bCf82jY:6Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286325, "uuid": "c97b06b7-3cb2-4a61-a6c9-ab54228f18a7", "value": 4626068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286325, "uuid": "3f09359b-22df-4b00-a229-3139561d2768", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286325, "uuid": "8970a9f5-b597-4023-9b22-26a7cc5753c6", "value": "POP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a59b5e-d517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765295748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295748, "uuid": "20cda125-8791-4102-99e4-7c4cb6df6692", "comment": "Malware payload", "value": "8fd3c6e7a1f03cef43254bd8cbc8835a", "object_relation": "md5", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295748, "uuid": "c2aab163-a51e-4291-be63-acbb12532f93", "comment": "Malware payload", "value": "58c5ba117fec8531f3558bb6209ab3684038893da139e9c0e051c94f6a3c135d", "object_relation": "sha256", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295748, "uuid": "15751897-3827-4d2e-b142-3aabf7ee8a06", "comment": "Malware payload", "value": "752dea0457e602b63122b0ff2f09c1d08b05524f", "object_relation": "sha1", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295748, "uuid": "0e5737ce-98cf-4058-8aea-d86c35b7bd08", "comment": "Malware payload", "value": "992988e2a1dee89aa67c03e67e75bbfbc1ea639f8ea0508b79e68b213566d04df0bf292767e73af6a75812fb091ebf87", "object_relation": "sha3-384", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295748, "uuid": "93c9f7fc-3c4d-466d-a3c7-13dfb8872f09", "value": "T1F5C533A2CF66AF03B4CCE91961F4D24F69CDD10715A2E1436BEBCE7E27366B4844CA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295748, "uuid": "1cec628a-6f89-4b93-a1cc-6a2b34a1389b", "value": "49152:chFHWtDcRJ+fz0QWrGbaXMLPXLjNQkvBmPMHxKkMwPYZJtqMTxMq21ZrH7:cfHKcRJ+fzZAGWXsL6kvBmPMUkM6MT/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295748, "uuid": "37f048f2-a53d-4d21-bb12-6089e20a8e87", "value": 2651232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295748, "uuid": "6ebbdc37-86a7-4b9e-9814-2cdc1b40dc47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295748, "uuid": "e902579c-ad02-49ac-b215-74e902c45259", "value": "libhttp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc02369-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765264428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264428, "uuid": "f22f9e90-ebab-4ee8-815e-6f39613cec4c", "comment": "Malware payload", "value": "c70edb78f62de9bbf17890d01e4a10ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264428, "uuid": "7a4060e4-1e66-4828-8e72-ef02eb4b8a99", "comment": "Malware payload", "value": "59e3df379d1bee477da8acee2283d64762b777d8f8ade123f98469ffa127ea9b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264428, "uuid": "d0d51010-3b6c-4c0a-bfa3-cc597ed77fa9", "comment": "Malware payload", "value": "c9b7fc8ce1dd69907d5b4f19b1aae183dc749181", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264428, "uuid": "8b7487a8-6318-48c0-aa4f-04e832dbddcf", "comment": "Malware payload", "value": "1674c81ea2a1c4915be8e36fa771e9ecd793b94cc8ca51ab93bfbf05b929e835b3a452f5e3506505199090b330a15c2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264428, "uuid": "ecfeb5ce-f246-4267-a865-f87ff7432744", "value": "T12AC533FEC9B91471C2E8C5F109A2B523A4D7DAC1E4908C0A8476C7A078D9ED6C597EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264428, "uuid": "44b32034-c809-40b8-9581-c97084493090", "value": "49152:JNhLYXnmSdaEqXjQ5zAfQOCNYr+cb9uBhOvlo0Mas/FmWF:JSmAaEqnQOCNYachuivlo9f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264428, "uuid": "b425c7b6-bf76-4fe3-8079-6f68f0036362", "value": 2667845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264428, "uuid": "f18bc677-1b1f-417b-a3fb-a57ab600b503", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264428, "uuid": "16283fb4-020d-454a-9971-68cff6b4b429", "value": "\u70ac\u5ba2AI_5.0_20251115_214144.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c9362a-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765278802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278802, "uuid": "37514c10-4a64-4f94-820c-d8e69502fa58", "comment": "Malware payload (VShell)", "value": "9f1f1d806f624b58585920345a3ca57a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278802, "uuid": "895c6bd1-55c1-4a2f-828b-93f9d99c02ae", "comment": "Malware payload (VShell)", "value": "5a51224b9624899d329fba297f6155e41013f1aa92a6cd6b4e058b11ceca79b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278802, "uuid": "ef84cf95-6ebe-4746-b6d4-9672b311bbee", "comment": "Malware payload (VShell)", "value": "a81333f7a27cd10a5f2929f3b2d47caf48afdf71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278802, "uuid": "db9d9c8c-9c86-4b7b-9038-fac8427c66f7", "comment": "Malware payload (VShell)", "value": "24b84ffeb972702754066041fd5a161b76ad0f6c013538fa7aa49f08618fa57da2ade78eb21a61354630c27677844b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278802, "uuid": "6e1d2dfb-52a8-42ee-a72f-50780fecb123", "value": "T119862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278802, "uuid": "33dbbf43-c78c-4e85-b976-ae22dcecef29", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXN:glRJXp8L/KyZcCb7uEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278802, "uuid": "c0d0a45d-83ea-4587-a88a-6c5804636228", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278802, "uuid": "41152d1d-34e6-465a-baf2-50c505eb6ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278802, "uuid": "af5ea695-a31d-4aa4-ac5f-7320bfeb4dbe", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dac7f3-d520-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299394, "uuid": "cb64e950-a2c8-4699-a68f-d113a38c3af4", "comment": "Malware payload (Mirai)", "value": "bde313f3c6af47e5dd024cc9b0b71637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299394, "uuid": "e4b777de-3c4f-40e7-bcfe-3b96ab2a6844", "comment": "Malware payload (Mirai)", "value": "5aef7feb18d48a567883aa480abbc80b87f97bf6fad2ad144eac5c82e374cc83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299394, "uuid": "c944d929-255b-403d-9e82-54c10f10f919", "comment": "Malware payload (Mirai)", "value": "aea48ef894d3cb97c4ec0ed08d91007ade426feb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299394, "uuid": "fff604bd-05a8-42d5-8fcf-d4f134199329", "comment": "Malware payload (Mirai)", "value": "ed099ad0d58158fa9730079ff0f40f067e4d87f91705a2d23b9943a35babf33cadaee9d91adf5048cc1351ec986f36da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299394, "uuid": "7e765b67-0402-418e-8074-462debbf01b9", "value": "T16673F946B981CA21C5D952BAFA2E51CD332317B8D3DF7213DD106F247B8A86B0E7B911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299394, "uuid": "c228ec84-70f3-4f99-bb92-7ada941620e8", "value": "1536:ftnkqAsPLz+AzamF2RzStqpyvBDglA00rN/z9xuO36M5i82FAbiaAT3bsR:ddPH+YF2RzScllN0B/j2FAbiaAT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299394, "uuid": "ef0bc96b-bc30-48b7-a691-58c5a9a96c43", "value": 76480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299394, "uuid": "99fbddf0-276f-42d3-ad49-5a49724e8038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299394, "uuid": "38718d6c-9dbb-407f-b068-bb620a8cb287", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe4154d-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300674, "uuid": "a2047da8-a9b0-47e2-a249-7e660e9e605f", "comment": "Malware payload (Mirai)", "value": "91dde5298ff6b16e51541c2d5ac3ebb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300674, "uuid": "b25b59f3-d295-42c0-b979-7b3500809d49", "comment": "Malware payload (Mirai)", "value": "5af18de9965ec5b65164155b5e9af924eb43935bbb002c1e581aa8e9551aaa0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300674, "uuid": "49068bce-3f94-4c06-a33e-97adba4b0d61", "comment": "Malware payload (Mirai)", "value": "758727fb1801f58c1e7d2632b194275a767ee5d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300674, "uuid": "fab0e5df-0220-4895-b2ea-49e80454152a", "comment": "Malware payload (Mirai)", "value": "52d3a6195777900c2def8e9e68905c8bc8f689aab0020b171406c0cf65e1b954c6e1689d37c22bde089b788f826acc44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300674, "uuid": "1b324bf3-b2c9-42ce-b1d8-fd2fdbedfd37", "value": "T1D1355C55F8408B62C6D131B6FA6F43AC73174BB9D3EA7105992887343BD792B8F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300674, "uuid": "4b0303b2-04f5-402f-8386-b3024a882a1f", "value": "24576:2LAYaPmCRU7a75y7k0uRSC7V+Siqsxe6m+XLbOvTi:gCS7aNypujiqsxe6m+XLbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300674, "uuid": "9245bcef-64d8-441b-a603-dbd663923d8e", "value": 1071740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300674, "uuid": "0c075ac0-2b13-4d9a-a312-2c3b6860e3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300674, "uuid": "612ea520-a5d4-4d08-b68c-ae4cb562ded8", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aacd602-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307725, "uuid": "65375b02-a05e-41d9-8eee-ce8bcac7ffca", "comment": "Malware payload (Mirai)", "value": "fa06926c73fce3cceacf1dce8b3c4324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307725, "uuid": "86adf897-6c97-4465-8157-3e4bf4dd29cc", "comment": "Malware payload (Mirai)", "value": "5c193ea1a17d8f29d3022d6c2385a9d8d7e0f3f59d9b5656a99446f12d07d192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307725, "uuid": "17b7a021-a77c-4e99-98bb-a6a756f5c855", "comment": "Malware payload (Mirai)", "value": "d2c7feffcd4b0b81f87c9aaf73deff0658dc5136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307725, "uuid": "3c6889e8-a6f9-4613-8862-7706755f97d4", "comment": "Malware payload (Mirai)", "value": "070a1c9ab04b0535c3ddd8a90a73629cc04335f5bc85caa6a57cb54a59142e381fdfc51894ca90564af974bdc5929fd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307725, "uuid": "234b5740-e45a-4b3b-b3cf-a2a5ffce2640", "value": "T18E93123DE709527AD26B94B71BD31700AD250BF720556487ACEE78E7E605CF473822CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307725, "uuid": "0e016ba1-9610-4a27-a104-cd57bb7ff251", "value": "1536:vsJykYR1aKZFAyTF2C27v31Fl58gDASlWc38ZP7oXxfwCOoHLbN0Bp0WKjgZllPL:vqlYR1PTTYC2z31F8g8SldsVoB4CbdVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307725, "uuid": "96bb5c84-f0bb-4e5f-9df6-6c1801e309b8", "value": 89200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307725, "uuid": "91fb9403-9ca9-4f9a-8031-fafb51c27183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307725, "uuid": "bc6d6fb6-7b8e-4546-94e2-4bc5c079c6a6", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6868437-d4c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765261037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261037, "uuid": "a4e9c4d9-d902-4a19-9e26-25bc5bc46130", "comment": "Malware payload (Mirai)", "value": "b23b6bc6152425af239d5456182fe20b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261037, "uuid": "d71cb2be-0c2f-4a98-8b54-e0c9f8d161b8", "comment": "Malware payload (Mirai)", "value": "5c84dacbfcf285720234d6f2d6e379de0f1efeda7fd327f3cd55cf91077f4dd9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261037, "uuid": "1d2e029a-cfbe-4cd9-837b-2d46856c936e", "comment": "Malware payload (Mirai)", "value": "47fa350433dbb06a86dffeb830e581665325151c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261037, "uuid": "66c2e99f-b9aa-42ff-86bd-6a3d706ebce6", "comment": "Malware payload (Mirai)", "value": "4f7cd7dc43d9aeed84e60d6903ebf4585b0a937ceb5f48c4dd51a0f66322a9d121b17abfb1b37dbe03ae3dc3bcf8469b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261037, "uuid": "d1e2fa19-95b2-4007-b391-d68d771ef216", "value": "T13D7162C91191B275AEA1C75265F649CAB2EAF4D1F1C41E0781E83CFB904DD07AA60EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261037, "uuid": "038fbf77-0f0b-4076-ad44-edd023083bd4", "value": "12:q0FdNjd0FdMjkp+0FdMijM4qO0FdwIjwDF80FdwxLjwxEqi0Fdwhijwhhq0Fdw7L:vehJ2bHWN3QdtvGa/auQRqe7J9P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765261037, "uuid": "57e7475f-175c-4f31-b520-eef1cc7984f4", "value": 3520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765261037, "uuid": "5221281d-7263-4745-98b0-50a77b8c446c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261037, "uuid": "074dbc1e-f781-42ff-9d8e-0cc9e6ca44cf", "value": "Fantazy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81c8445-d4c4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1765260154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260154, "uuid": "39642cbb-e9b5-4fa7-996b-fb045f9311f1", "comment": "Malware payload (SalatStealer)", "value": "3412a5a268ebcd84e3f84ed91ddc1a17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260154, "uuid": "fd043378-732e-471f-acfe-5de0cb5628c8", "comment": "Malware payload (SalatStealer)", "value": "5d346dd20bb2bcca16508edb45efbfe5776cd22672eedd15e67498c2a857ae01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260154, "uuid": "59ea8bb6-1511-4a30-94b0-4b5e93d4aa7b", "comment": "Malware payload (SalatStealer)", "value": "4c8461039387127c26846c78a916d618bb67c9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260154, "uuid": "70cf2e96-3a5a-4870-b82b-b7ea55615281", "comment": "Malware payload (SalatStealer)", "value": "1ae2d24666791e29beadedbaa569280ed1e7423cf793a62af1deab5b30aa0fc99680a6790dd8dd8daac1aa8a28b6ab80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260154, "uuid": "bee6fea0-75b2-4833-842e-384ac0159a6c", "value": "T1EDC65B11FA8B94FAE9031835405BB23F63355E048B29DBDBFB543B6EFC77681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260154, "uuid": "266797e2-6b8c-42a8-afeb-187eaeb3b8c2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260154, "uuid": "a03bbcb2-d3e3-4317-96b4-4dee230f6115", "value": "49152:XisIvXa8SRC8UR5N/3DbZNVRiLl8WH8HgYmpghzFOsNvqN1qvBj6cng/iOCMUNGC:SvvK89h/3JNVswFMmXh+PaecPZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765260154, "uuid": "594926e9-bf1a-4143-b81a-3bcf8c9cd33a", "value": 11662848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765260154, "uuid": "8b59589c-4982-4e65-92eb-5d4cadd18b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260154, "uuid": "ea22202d-229a-44e1-897c-142df6b772fc", "value": "17cfc6bae7a7f5c26f36fb8f9579b23d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96600ea5-d51f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299209, "uuid": "2c77792c-5c73-4a8a-95ee-a68417127fc8", "comment": "Malware payload", "value": "11e39144aaf9c497d221787b138bb7f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299209, "uuid": "800dc667-627d-471b-9203-9ab2b0cc2a25", "comment": "Malware payload", "value": "5d682ffaa87c75c09bd1a40c71563c89390260155b716a03ca716e616e67e726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299209, "uuid": "bf9d0321-5b75-4e16-bc0f-4e80ef455054", "comment": "Malware payload", "value": "633d56b92f6308edf985be4fc947ed04a8f14e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299209, "uuid": "0cdfdd6d-6a6c-47fd-a9db-c08dfbae58ac", "comment": "Malware payload", "value": "ca93c05bd7d3b6a2de8c6f927c1661975b7e76483e84a0ed1fdfc2f803f4f83ba39d7a6fca474db2e79c73dcfd30618d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299209, "uuid": "3adf170b-7660-4a32-90d9-d3ca201d2c9c", "value": "T1F913D786B891CA16C5C5A1B7FF4E82DC371603E8D1EF33039D19AB657A4B86B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299209, "uuid": "fb1baf6e-4d29-4d96-a60d-2ad6c2ade528", "value": "768:VrLhS48n5q+6+Q687X3aMiLDsGCXwGuLSmStRhNh7pHGPtIhUZeMtqcT3bsRGn:5LhS4nZ+Q6WG8Rtr7YPeHM/T3bsRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299209, "uuid": "ae87464b-d47f-4b62-a8f9-91cf38d30148", "value": 44076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299209, "uuid": "d0cc123f-1529-4126-b69a-5fc3b45806be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299209, "uuid": "00030690-7c41-4a63-86c1-6ea6dfe3148f", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aef09b9-d536-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765308907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308907, "uuid": "23f88b82-abb4-48ab-9da4-6ceedbf17003", "comment": "Malware payload (AsyncRAT)", "value": "804535fc5f5c8c802ebd2502c351b57c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308907, "uuid": "c8099ec9-f408-4b3c-9805-f7dc85754922", "comment": "Malware payload (AsyncRAT)", "value": "5e680cd8708e4e87ef858a5a8921157e7e8bc13a7ea04a93086a7996642605b0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308907, "uuid": "915659b7-c0a8-4b45-84ed-0051e2db2d7a", "comment": "Malware payload (AsyncRAT)", "value": "237e47469bc88e7e715bf6d416ae3d5e1d97249f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308907, "uuid": "672faf88-cc44-4b53-a73c-ba3acfc40dff", "comment": "Malware payload (AsyncRAT)", "value": "a8adb675623c9e6846ffcc60edfc2a52719a96f356b372ef16fe0c1dbf69a4d8860036a7b6d4bf66f72fd277256be68d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308907, "uuid": "1700e5f7-3ae6-4d7c-b162-cc2e2020f410", "value": "T136233B0037E9812BF3BE4F74A9F26205457BF2773603D64A2CC451D65A23BC69A429FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308907, "uuid": "5d699b1e-88e6-46d6-8f73-755179e5b8e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308907, "uuid": "66ea9b1d-a741-410d-89fc-46f3725f99e4", "value": "768:LukzVT0kLd3WULVPdVmo2qDXDS9eCSY/2wWeKvmcd0bk6hIYLvd/RscDr3DcDZ9m:LukzVT0M912U9YejeKvIbk6WYL4c4d9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308907, "uuid": "d9e845fb-f135-4bf0-9efe-b1f57903cda8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308907, "uuid": "cf1f92c1-94b5-4713-8cdd-012045fb71d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308907, "uuid": "5e99dede-783e-4404-8a22-6e0c0d242004", "value": "5e680cd8708e4e87ef858a5a8921157e7e8bc13a7ea04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd76189d-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765286067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286067, "uuid": "906b8b00-0057-4e03-93ea-f7994c5e62ce", "comment": "Malware payload (PhantomStealer)", "value": "09d4876d26b2f2924fbf642d304affe6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286067, "uuid": "2e726e9e-1a06-4ea5-a79f-476183f1cc59", "comment": "Malware payload (PhantomStealer)", "value": "5f2c88e3e323acdbacb623809540a8bb718f7dee9f30b9f85fa75e507a7c6131", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286067, "uuid": "68dd4057-9fa3-45e5-9938-0832617c5a81", "comment": "Malware payload (PhantomStealer)", "value": "e65c51732742732b7fa145edd2b2ec880b59245d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286067, "uuid": "6e52c5d2-7731-466f-b766-3586032b317c", "comment": "Malware payload (PhantomStealer)", "value": "d54a2f85d8a4b2abb4cf4985a5ab287eab4cbcf345793295c7683c81c1c214f02475830dbcaf69f9e40f05c0e1a148fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286067, "uuid": "3c3d2a3b-bc4a-49f0-b8e3-f4b08ac6d16d", "value": "T1BB06126FC576F915F66957606F40E10683F2842AC87B0A57FE1A8F88BB359421DECC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286067, "uuid": "084924aa-f168-4d2f-af37-8a02eac1d46a", "value": "768:k++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++X:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286067, "uuid": "72117d6a-ebe7-46af-a2a0-38e9c3cbbff7", "value": 3913619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286067, "uuid": "ec9e8540-c502-4999-a35a-eeccfcc0c734", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286067, "uuid": "4248e496-7eea-4362-8025-69c1a6fdf89e", "value": "Paymnet_Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b3a133-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252384, "uuid": "cdc63a55-6bb7-4a9a-863d-e904d3217365", "comment": "Malware payload (Mirai)", "value": "6eb3ddfa3567f1157d2c5f3f5a3b4a42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252384, "uuid": "987c2810-1d60-4ad3-b9b8-8c38357ad989", "comment": "Malware payload (Mirai)", "value": "5f337f54cdc1231606c807b50d03ca455c4c7214098b79a1437da21fab19d41b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252384, "uuid": "293142ce-d885-454e-8694-f86d4be9d25d", "comment": "Malware payload (Mirai)", "value": "141e4409556e193d529c52232976d7ca8c7d97ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252384, "uuid": "03da5d19-549c-4e6e-b2e8-39ed2d216798", "comment": "Malware payload (Mirai)", "value": "cbbc0bdfb1b054d2e027b5b68d9e4c3f8b37322e08624fb51f7e015427ff1606d214d1cd6d0e4f16da2c7ae2670f4da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252384, "uuid": "83e6c93d-aa00-4c0b-b6d1-c014f2d7479b", "value": "T1E0E35A0770D0A8FEC8D5C2B48BEFB126D972F1591234712B27D4BE266E9DF212B6C650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252384, "uuid": "8cb0f6cf-300d-40a9-8821-965e1dee4f38", "value": "3072:13IzId8ksIipI/yXXI1nJvYaFS7WGjdGe+B9UTU:1dJx0U/Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252384, "uuid": "b6ce8f74-670b-4cec-9081-1c74aca85fe9", "value": 152752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252384, "uuid": "e7fce576-3bef-473b-9085-ad70efd3c10b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252384, "uuid": "d77ab056-8f93-44c1-9cb9-8c9b1abc94bd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d4e4bb-d526-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302159, "uuid": "7d800901-8817-4b69-9bfd-d8e1efd9f657", "comment": "Malware payload (Mirai)", "value": "d8ca5e69526b97ad4a32c74443d8f0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302159, "uuid": "9befe9ce-a2df-42f3-9c3e-c26590e1c35f", "comment": "Malware payload (Mirai)", "value": "5f7321c69153ee339ebaf3b9134b3c11e8ec03be703d8d19080a5eef22b8b611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302159, "uuid": "faa658fb-fc43-4152-afd6-6ec371e89ef6", "comment": "Malware payload (Mirai)", "value": "ef45f9940ecc73207837b2b105bb24ab38c7798b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302159, "uuid": "9eafa319-04ba-4514-a088-1e66fbbfbe2a", "comment": "Malware payload (Mirai)", "value": "1b8729ea059dcdde35ec6270edaacf144afa30abacfdb6e9cff3341720af1de3f28ab163528a2b9c1dd19a581eca1715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302159, "uuid": "c2104707-416e-41b6-b2b6-0eeed65a9e8d", "value": "T16A43A5092E319FAEFB6CC63587774E209798639536E0C688D66CF9055F7030DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302159, "uuid": "ce05e59e-208a-4c54-a79b-a56812c39d38", "value": "1536:8DHLUC0DslCHhhUGXNqY3sptaLXLIzLaNzLLdAU++1KUrLT3bsRSO:aKDmCHhhUGXQY3sptam81zLT3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302159, "uuid": "60072e61-a886-4cb8-86ca-071f2fec6fc1", "value": 59696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302159, "uuid": "a41ba93d-b7e6-4d2a-b9c2-9700d7755bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302159, "uuid": "0b44d303-4520-47ab-9aa5-098f2163087e", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1542f4-d4c4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1765260136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260136, "uuid": "fc5d5382-b6ef-4ed6-bc0b-d56968330a67", "comment": "Malware payload (SalatStealer)", "value": "17cfc6bae7a7f5c26f36fb8f9579b23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260136, "uuid": "fac90a5a-a084-46fe-9184-7db3566af978", "comment": "Malware payload (SalatStealer)", "value": "60813f4133c31753313a9b85fcabecbefc1dd5f39a727beaf2f3589f42e0f315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260136, "uuid": "58b540ac-2624-41bd-99b7-a344b4b7013a", "comment": "Malware payload (SalatStealer)", "value": "6875b87dadaa51141f722f13044a994cadfae4a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765260136, "uuid": "cd590f22-afcf-44a0-bb84-4a93a280a8d1", "comment": "Malware payload (SalatStealer)", "value": "f7b47228379616e854912c8b2848a9203a2eb5ca8ab6a5fec32842b5b8f7317a3bed882ae231c7227acc8644a477a2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260136, "uuid": "c3f5ec91-916f-4c1e-9056-126d363cafd4", "value": "T186E5335160C36934C6A21773BA43FA42C49ECBA2FB8C5AB31A95053DC7B52C1B4DF61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260136, "uuid": "64b79515-8a9e-44ac-9e89-7243aedc51c0", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260136, "uuid": "8f45677a-c201-4cf6-adbe-dd01c1e3aec7", "value": "98304:CkYohnMmQjaMbHwgNl2ZTcciVlPWpa4vkRm:HYoMjjaINGiVtWpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765260136, "uuid": "203de5aa-bfe1-46b5-9a47-803d2bd74d6e", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765260136, "uuid": "efb427b6-5c1b-48d0-8026-e7adc3ce60a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765260136, "uuid": "66c9ba4f-6642-4e5b-a3c8-29ad57d53b9b", "value": "17cfc6bae7a7f5c26f36fb8f9579b23d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c74102-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264415, "uuid": "e181c8fa-3dcf-4b72-9cf4-053109304384", "comment": "Malware payload (Mirai)", "value": "b42318ef9af5cda27dbbadece1a5edb6", "object_relation": "md5", "Tag": [ { "name": "dbg", "colour": "#9C42A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264415, "uuid": "ebb450fe-f157-487b-81e2-126ace6b9674", "comment": "Malware payload (Mirai)", "value": "61ea251b9fc6e4b72d211ebd56104d4864fed88ecb5ccca14170270c53fe907e", "object_relation": "sha256", "Tag": [ { "name": "dbg", "colour": "#9C42A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264415, "uuid": "9d555510-ff74-4e6e-a871-62dfcb652504", "comment": "Malware payload (Mirai)", "value": "5c4d421f2239ee8c28dd18861db42fe74d1b2b17", "object_relation": "sha1", "Tag": [ { "name": "dbg", "colour": "#9C42A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264415, "uuid": "7a522e7a-7a4d-483f-a4fd-6a3a67903675", "comment": "Malware payload (Mirai)", "value": "1865f7a3091ec55cf6265ea4988eb65241200dd0fab7642432c0dd301e402b1d481fddc46be5d6d6560e518ce0dc3f44", "object_relation": "sha3-384", "Tag": [ { "name": "dbg", "colour": "#9C42A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264415, "uuid": "50b8f814-b1df-4c62-b7c0-d21aa4ae955a", "value": "T11D359F56F2B375BDC027C1308BABC7616A35F07415316D7B22C4A6342E62EB05F2AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264415, "uuid": "8c9fe9c5-6f79-423b-8ef5-2ee552062b07", "value": "12288:K0NCrpZtyYgddlCwWBg3Zs3jmyQbR/g5kcCs3vYZwLBUV:K0NCrpZteddlCwWG3Qm11s3vCwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264415, "uuid": "65f55c2f-c941-43e3-a968-84ce90983f49", "value": 1126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264415, "uuid": "2ad7116c-ff7f-4cb2-843b-badbf1bad18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264415, "uuid": "6c434ea7-12f0-44e1-95ff-66a12e0c9020", "value": "mirai.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a12333d-d53b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765311107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311107, "uuid": "d42827d2-c594-499b-bc6c-3de3b198b687", "comment": "Malware payload", "value": "9cdfb1bc9827bc97d7ad8019c8a9eb43", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311107, "uuid": "2cfef690-d8e1-4e2c-a890-edef2ab8036d", "comment": "Malware payload", "value": "623b7176808190219e46f07340dbc483297780bd1fe920094bbf8e4633a4e93d", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311107, "uuid": "ab700985-0c9a-4eda-99fa-46d8fe87355c", "comment": "Malware payload", "value": "d06f3f69328b261242066a3eaf7bc876b19b9c92", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765311107, "uuid": "215ed7a5-326d-4b5e-b602-f99c5ed7a58f", "comment": "Malware payload", "value": "bcc24cb7577f2df31ae0cac63e173a2534c855afba37129ed97efec361a14ea1d7c91cd95916cc4cd286ef93a396b1d2", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311107, "uuid": "57b7846b-d69c-4ad7-b36d-695489e30fe2", "value": "T18CF733D1DA911E716F1FED3F1572C129D1C3721350816C2F7A923621B89BBDAA3BA8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311107, "uuid": "95f0fe18-5646-4704-bc52-1b1289825d4d", "value": "1572864:heZbt9fPBjiFQxFSPzLUaidZKo8alzFr/DXCp3zWVF/Ov8i7MwBTO2YEed:heZHfpuFYFSnUaidZKoxldzCEVFu8i7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765311107, "uuid": "8511a1dd-5249-480b-a860-c7ba711fd4c2", "value": 73973870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765311107, "uuid": "64cf7dad-a338-4f9e-b27f-5987387834d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765311107, "uuid": "2d20162a-f8af-4301-ac3c-f56c45d4d1f1", "value": "Lol.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128d2a81-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298558, "uuid": "0d11870d-b352-4650-af1e-956f9c1a6db1", "comment": "Malware payload", "value": "b4a86e27f0a70da966cea071f6daebd0", "object_relation": "md5", "Tag": [ { "name": "85-208-84-110", "colour": "#BFF516", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298558, "uuid": "2b37fb41-ab87-4a0e-9892-f30dd8b5793a", "comment": "Malware payload", "value": "625c148f7eacb68305880c51c7b7c217862ac253a6a804941c9d9224dd4e13e2", "object_relation": "sha256", "Tag": [ { "name": "85-208-84-110", "colour": "#BFF516", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298558, "uuid": "54e6f13e-edcc-4db2-8029-bf90e7eb51b5", "comment": "Malware payload", "value": "939da6ba42b07b59713f8a921c234dcf12b2ac43", "object_relation": "sha1", "Tag": [ { "name": "85-208-84-110", "colour": "#BFF516", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298558, "uuid": "55ff9b33-7455-41b1-b398-09fac30f874b", "comment": "Malware payload", "value": "dde4204f08ddb44c05c0ca0b19d46b1f5c13f69b0d0ffe2a5ecea22f35d3b4b6620305c8c2334630c3fb8e18fb021394", "object_relation": "sha3-384", "Tag": [ { "name": "85-208-84-110", "colour": "#BFF516", "exportable": true, "hide_tag": false }, { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298558, "uuid": "c446f2d9-9597-4464-a299-929a6ec7f0a2", "value": "T16EF423AA0676EF16CE4C1CBEC183F2C383BD9835156BE51F766CD6882B593E5DB08841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298558, "uuid": "9acdef02-b974-49c0-8f4f-a0b0d195d15a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298558, "uuid": "8e0891f2-b69a-4211-b8da-0f66f4ca43dd", "value": "12288:yiwOGl8MEDRJbhrPox3+MSI34sxC8XTQZepe0oWkrp2qu:HXMavNMOhIbI8Dqe9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298558, "uuid": "af9724c4-dfbb-44b9-879a-537058cd65ef", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298558, "uuid": "e60f8794-54ee-4939-a09c-6843d8c383a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298558, "uuid": "9205eea4-091a-450e-94b3-5b5177788096", "value": "625c148f7eacb68305880c51c7b7c217862ac253a6a804941c9d9224dd4e13e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d358c1f-d4d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765268672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268672, "uuid": "bc5eb011-bbbf-4696-ba51-854c745db58c", "comment": "Malware payload", "value": "1fe13ef48bff18b3bd8cbc2d07ea0045", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268672, "uuid": "b4655122-90a1-4d9d-b247-b08ec3ad5c68", "comment": "Malware payload", "value": "62fd03bdf9c53269615883519cc93c38013aac356e31913c13c90df7a7f14dd0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268672, "uuid": "d3c5bd82-d319-4d4e-8602-51d77a82430e", "comment": "Malware payload", "value": "7277a124fb3ea5796a35e08ebb29b604207964f3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268672, "uuid": "25df5fbf-1438-4878-9c49-b52cec24bd2b", "comment": "Malware payload", "value": "3ed96c4e4ba4cb45b55bee493469ac6724a47ce222386f73a373905bb069a19e38295366a8b8bdee965d3fdebd050667", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268672, "uuid": "72b27436-8757-45ce-aa0a-adcb8a5203b1", "value": "T1154329A0D964036ADE4B32EAED441530C57CC257053740A1BEAC13ADD6CB6DCA7BD2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268672, "uuid": "4fb1438f-9e10-4e46-9701-f9ed3ef545bf", "value": "768:HvcOHrpGv0P+AgmcxxvsVIOZozeaY0ayFv3r0KBNU9rHhgDimf73wnRkhiSUy:PNroM5c0JZBa1FTk9uIkMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268672, "uuid": "8e79cf44-3499-46f7-b67e-3c0053367342", "value": 58438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268672, "uuid": "d0b96398-a9db-4952-8433-24f54b92e2a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268672, "uuid": "35bdc177-f223-4684-baf6-2f2d6ed78521", "value": "Maersk_shipping_document_confirmation_request_0000000_12-09-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dabc1a2-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264405, "uuid": "6c4f0587-d3ce-4325-9539-63ac2723c76e", "comment": "Malware payload (Mirai)", "value": "7e24ef8985fd1d2025850d6306abd49b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264405, "uuid": "0fc8088e-d35b-4ce4-a32f-492ade234e18", "comment": "Malware payload (Mirai)", "value": "650c3b3d970d00c8bcab1cdde8201cd63a55e2690799389c7ef15162f5f1b9de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264405, "uuid": "d0453234-856a-47d0-8b1f-0b59b13a4ace", "comment": "Malware payload (Mirai)", "value": "ac50471143663152fd8f08fd2f5af84f7c684267", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264405, "uuid": "5743eb4d-1bb6-4cf5-87b6-0104384620d3", "comment": "Malware payload (Mirai)", "value": "1a872dbe06c65320ce4f399034da55a2e056600a06c97b6ce7098c4c7103dc898f6e90b3d7baf1a5117e4ba62d886ce3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264405, "uuid": "1b1d6784-a483-44d9-a009-b5b1fdeec217", "value": "T13DF0EBC4270310BA9A4E4C0A5B2E73C2F04B0C6714002A9EE04C9F707F4FC85E23EE14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264405, "uuid": "4004cd36-0f70-420b-ae19-02fa8bb41573", "value": "12:sgaOZySt0u8SmFe/Y5NFFxNd1BFyT5WT69F0qFteQ9fFswauYXFQ:sFOBn8Je/YHFnEcpieQ9fKhuWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264405, "uuid": "a1b32f4f-e37a-4bfd-97ad-b74b31c0fbca", "value": 540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264405, "uuid": "d1e9537d-32a1-4d0e-b521-4d3d92a210f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264405, "uuid": "472d284a-df6b-44da-b669-30b1dc45f362", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6075ea1-d4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765257601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765257601, "uuid": "31a2ac38-e16f-4728-bafb-486e7de9212e", "comment": "Malware payload (Mirai)", "value": "5ee31edb994240b552030fdfb2462906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765257601, "uuid": "d5f9cf38-0c34-437e-ba9c-d37cceae0822", "comment": "Malware payload (Mirai)", "value": "65b5a782c941346495e1c7e2f6bd858669bcf935c186e3ff3b5d143e65a124e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765257601, "uuid": "9bb6baff-1bee-4de1-803d-46a2e10a0b3a", "comment": "Malware payload (Mirai)", "value": "f7b9004d4aa1616c628a44bfa0e305af3251d1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765257601, "uuid": "8da11575-aced-43a0-8a16-16f71d068c93", "comment": "Malware payload (Mirai)", "value": "0f0b2969069f55b7abfa8abb4087f4f6a55d50d4e0bdc2cd89522d771fb9c9e391500f480954450c90f1c52c9ff7c6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765257601, "uuid": "7d18d244-22d1-423e-bfc7-a5c6344bf7cd", "value": "T197733B85F9C745F6C9178934A1ABF23FCA31E5794070966DDF896F32DA27B01910228E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765257601, "uuid": "41bebaeb-dbd7-4cfc-bafe-780313c5412c", "value": "1536:Kt+qZs87flIJGrw7VODopsKqhGfbkzdit5mZaFvigERMSlcQ:Kt+grLqJGrw7EDop4hGfRgaFqgERzlcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765257601, "uuid": "2515c498-2e46-495a-9fb4-580c8517cd51", "value": 78608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765257601, "uuid": "a57b5396-9205-42f8-9a48-f65df5d3f404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765257601, "uuid": "919d55cd-b1bc-4dfe-b524-5acf4ba598fd", "value": "Fantazy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0127b98f-d4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765272330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272330, "uuid": "010a9fde-cfea-41d6-8043-59a6ed5f5145", "comment": "Malware payload (PureLogsStealer)", "value": "6c765f0ac9b22e095aec0c5a23d4c6c2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272330, "uuid": "73d3445c-505b-4064-9c84-eb083e7cd3a8", "comment": "Malware payload (PureLogsStealer)", "value": "65ce0178ab30e4a96ce574b7559ca01bd9f114f0605a5be6e0284256f88d83e5", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272330, "uuid": "f620b1d3-638b-4ac9-ac30-59063f6ea987", "comment": "Malware payload (PureLogsStealer)", "value": "e279a9a66279563371c5ca75307dd2fccb6fbea9", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272330, "uuid": "82ef9e6a-28c5-4ed0-8f2c-f490ebc128b0", "comment": "Malware payload (PureLogsStealer)", "value": "925b879941c16e1e390f312404f3cfda6c285888c948c9b82009aab6957f3bfe0677643784408f4164659198773685da", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272330, "uuid": "b35473cf-f32b-4e6d-bcb0-3a39f629aba3", "value": "T100942332A561843BF35484B3FC3BDE94450664CC4AD425961BAF9A523F4A2E0E3F8FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272330, "uuid": "be5aa383-e4d3-4e47-9562-9946b6d8f4c7", "value": "12288:tTKMZrj8TIVaHIRPspUirRiH/l56vyEqL4AWxQC:hKMZrjUIGI1uUGyl5iyECVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272330, "uuid": "d92f4529-e4eb-4556-bea4-4ed6b49bfe2f", "value": 440020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272330, "uuid": "c8dedfe7-9855-4554-ae23-4d22895c341d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272330, "uuid": "5715a7ca-5e09-46c7-a69c-33a29b767e47", "value": "KJ-103Swift-CN8400-GF4022-PL0039-YF4893-CHF849-JDE0003-EA392-KS9400-LAWIW.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3763a6-d509-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765289748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289748, "uuid": "2d7b1830-f558-470c-ab72-db2e69913de6", "comment": "Malware payload (SnakeKeylogger)", "value": "1155a56edcbfa6d787b6f6a8d76827f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289748, "uuid": "722ea2b1-20f7-49b9-bfc2-86399c43a462", "comment": "Malware payload (SnakeKeylogger)", "value": "66bdb49f74847c51999683a68ce9838a639328c8ea30d2ef35762713e18594c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289748, "uuid": "6087ceb4-1ee6-4098-a428-c83a40e07961", "comment": "Malware payload (SnakeKeylogger)", "value": "2bb837b34414533f6df4b4f1caf4158ae6060623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289748, "uuid": "34111048-c46f-4ee5-a268-2ed6694ca038", "comment": "Malware payload (SnakeKeylogger)", "value": "9110cebc45cb09f0f90a395179d16035fd516d550c7d09b26d751a08fa5d86610712e9ed0f36a871716c5c2ce4df3a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289748, "uuid": "a5e08ada-5e37-4830-a913-6a8163bf21d9", "value": "T18D3523502E25DA85051C0379F07B6F9FACF4BF49440859A17ACC1D8A93FF7B25817E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289748, "uuid": "199f402f-5811-4fb0-96be-6ded723c940e", "value": "24576:2ZOGb1AqaDIHgZyu739hHWD2zoMMvL84XoMKCLCE0LTNV2:2ZOGG7D7jCft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289748, "uuid": "c1acd42b-e36b-485a-ae98-c56940ca7260", "value": 1109092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289748, "uuid": "51a3e67b-6056-462a-9546-e9847d62efa8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289748, "uuid": "98e71577-d65f-430f-88b7-e5ea6a3064d2", "value": "5z9g9i.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f762ac18-d4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765272313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272313, "uuid": "b3c21a41-606d-49ba-9ec7-6f0c2779d64f", "comment": "Malware payload (PureLogsStealer)", "value": "cf9ca1a410674e1af26582ca113f89b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272313, "uuid": "c8523086-4788-4af8-a6ef-3fd8dbe2fb4f", "comment": "Malware payload (PureLogsStealer)", "value": "6712822d0051f3cf96949990caaf64dc9f9b0ed059d80fdfa040170dc2199cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272313, "uuid": "0018ed7d-ce37-4c1c-a826-67d262a5444a", "comment": "Malware payload (PureLogsStealer)", "value": "115c629f2d16ac5cbd91f2aa3818ddc58baa6d25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272313, "uuid": "8ccb7d2c-f2db-4ce1-ae44-ea50b510beed", "comment": "Malware payload (PureLogsStealer)", "value": "98273d4a3212bfdcc09d2e5326c74fc4bc534bf6456883ad1bf85ad0b23a33f0438412f6a2c12ed8af8fa7d5a426ce1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272313, "uuid": "898b7284-61b4-4d8a-b8aa-ee2553599fa3", "value": "T1EC35F1E83A31731ECD5289319A68ECB092A42DB971067AE355DF375B758C106EF0CF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272313, "uuid": "525a3f5b-a2c4-4eaa-b69f-a6bc0d59d39f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272313, "uuid": "66b12f0e-a9df-4c7d-aa55-6d31f8c56f1d", "value": "24576:Nrl9QHc/ijyMqoiXaQwJ6JxNxqK9NS2THXNsxHP:9lKHNjZtinwJ6jOKNPRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272313, "uuid": "bf9ef1bf-049e-409d-8be8-06130d72a6c1", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272313, "uuid": "8fcaee08-1ac7-4f3a-a9b1-807a1134baee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272313, "uuid": "60d4d16c-15d2-475c-8e58-018b68fd24ef", "value": "Mbbank_07860731.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ce0ace-d523-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765301040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301040, "uuid": "cb0b29bc-6ac1-47cb-ac88-058c5ea5013f", "comment": "Malware payload", "value": "6d5465f275cdbbb184445dcabd0406b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301040, "uuid": "83fd3cd4-8a37-4c33-9a8f-1e1ca319767e", "comment": "Malware payload", "value": "681cf64b112f74f7fd444ce91b5b67595f52ce791d5c63a290cc51943bb1e130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301040, "uuid": "a6d29ce6-6319-4cfd-bf7b-9286d466161b", "comment": "Malware payload", "value": "5e5f9ae60c2dde2413736796fd1ce2a221eadd78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301040, "uuid": "9f9e6124-de1c-4e4e-ae2a-566bab4ac74c", "comment": "Malware payload", "value": "7a4272b75b6625d1cf2a103e8c03dea900af28d46c478c737d7eadd88b2e733c9ad3f14335c5c27e252e1169b619052f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301040, "uuid": "721a6871-6452-4f54-b93d-f8323bf5ecac", "value": "T10F73B60A6F258FBDFB69C63647B78E219788339227E0C645D12CE9015EB074D641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301040, "uuid": "05a6a91e-7643-499f-a0c8-47abb135fc4d", "value": "1536:xVdXi60/ZPpYfu05Jn2vV11/EbQnv0rv6trvvS5WFuI9T3bsR5GUnI:xfiZ/Zen5Jn2vL1/CTWF99T3AnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301040, "uuid": "8c72a4d8-002b-4472-a723-2668a0c0bb6b", "value": 76420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301040, "uuid": "44947490-1174-442a-b289-0df51d590eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301040, "uuid": "aae1a157-5197-4cfa-a68f-3e36ca650c46", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b75f94-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287927, "uuid": "7f357e4b-2aa1-4664-a625-98de17514db7", "comment": "Malware payload (Mirai)", "value": "c4f69fa2e07cfa530a8290fb3c5026fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287927, "uuid": "ba9d2add-cba5-4653-b61b-aa2d64f3cd38", "comment": "Malware payload (Mirai)", "value": "685d10f18ee12ea5ed0150976c83c217ba3bba73049bf9755a7b36c57c4fe7d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287927, "uuid": "826e8b5c-c1df-4bad-9823-284c9fc5ee42", "comment": "Malware payload (Mirai)", "value": "5f8f1f033caa8651e55c3e84af11d283e2648115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287927, "uuid": "836e0a76-1481-409a-8a8c-2a319c798cd7", "comment": "Malware payload (Mirai)", "value": "ec0c892e9f1e74f2ae81728fc44e157cd4caedf72874617905066f3e260891ab61ad8e5388365c3d5da3b52a29f50479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287927, "uuid": "d8fec33e-2800-4b49-a47e-462a2ffd8ecd", "value": "T19684D08AF7562D82C9EBC5340486C645575AE19723F3834A3A476A7B3C193B78F2C389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287927, "uuid": "5e22386b-8c46-4f48-acfe-6b37c0aa5d95", "value": "6144:sP5Gfg+oMwi1fOly152L000Cv03PWw3kjXpG1OmYgpjmnd:gGIzMF1OlAYw/2XpG1ogpjmnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287927, "uuid": "5ae49ceb-8cab-4da2-82e3-8cf354bc8f60", "value": 377940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287927, "uuid": "1625eaec-baef-428b-8d54-957a1478554b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287927, "uuid": "99db9f3f-1a5c-449a-9018-0b2b9369bf47", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b16943-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765286408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286408, "uuid": "54d2008c-a251-4982-a6c8-9cf53e7c581e", "comment": "Malware payload (AgentTesla)", "value": "428ea6289cf00abd0b3b46e0105115f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286408, "uuid": "402eb263-6a34-4872-837c-eeee5b4dcdee", "comment": "Malware payload (AgentTesla)", "value": "68784f03a931b7721c12524c381209768d2db51a03af6293094c1baa0c15ebe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286408, "uuid": "ba980f72-413a-4c87-8a24-ca49cf78894b", "comment": "Malware payload (AgentTesla)", "value": "bbbf9af4b7f47d243964415cf3d3bf80939a03f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286408, "uuid": "e5fe43da-40e7-41e8-922e-61eaaaa35fca", "comment": "Malware payload (AgentTesla)", "value": "00e90a3e8de498db2873adb48bfe16fcddb65b1dc73eb2f7579c5650cc45fb75ba8406325ddcc0b4c8fe33fa537caaaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286408, "uuid": "c2c8e0a9-8cf2-42e7-9c93-f1893ff43090", "value": "T10283738463C0B46803435FBABB2FB1E9F96F09D934A9494BC121FD90B574706EAE1D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286408, "uuid": "665002c7-ce5d-43b0-9597-fd2f007a8126", "value": "1536:2fh/2LbWyEq4zoCL0IQuxGm6P3R+pvWluE7XxtWvxgL:2fWF4SIu3aOluENV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286408, "uuid": "fd9daefa-5ab5-4d3e-9687-2eeddeee9319", "value": 85319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286408, "uuid": "d2ee4b52-a74b-4c9d-aa45-1503f81ede22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286408, "uuid": "4a45b6c7-5c54-4f4a-b903-6850a8f233a4", "value": "Signed_PO_SHAJI NAIR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc198f3-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765286843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286843, "uuid": "aa09ac07-2ef3-4d9c-a4c3-4bc279a7f784", "comment": "Malware payload (XWorm)", "value": "dd44d144e9a191d88badefbfa43d431f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286843, "uuid": "20e59943-6849-4261-ba04-f03cf184bba1", "comment": "Malware payload (XWorm)", "value": "68fa0dd6b006ddf41bfd6caee99a66506b5b56c1c86df77a7bacc761e6b1aa82", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286843, "uuid": "819b4ebb-791a-4197-862f-e4db91726056", "comment": "Malware payload (XWorm)", "value": "8bfd13ba4f55d8da59767bf064c1dd4baee625d2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286843, "uuid": "1571c099-3dd7-4561-87ea-a16ee2fa1f20", "comment": "Malware payload (XWorm)", "value": "021e0f1a006b7d0bc6913500224e489d3ebe4c63219b2f4f7e00fe94713096a637286a30fa0c3e165402f1051914e82f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286843, "uuid": "ba75dca5-4bb4-4f0b-b450-066611023946", "value": "T1E38513760DA302EC01CE7707726A32853589C9C431A8F1669DE2DFD79FBA65C636A0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286843, "uuid": "ce7603f2-46ad-42d4-b47b-a4d57a4d5780", "value": "192:LHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHp:J0TnilfkfVdsynxaUFmG8BEML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286843, "uuid": "eca3a5cd-e804-42ce-a7b5-e099b961db1a", "value": 1873772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286843, "uuid": "46a78e1e-478f-4bed-8804-e7272d82cfc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286843, "uuid": "8ea49b63-d3a6-4658-8473-80ef34ba8ad5", "value": "New Order Request.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70968a-d552-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765321283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321283, "uuid": "b71aea40-511c-4b28-870e-270a8c8cc74e", "comment": "Malware payload (Mirai)", "value": "b3f34726bcd92556842c9bb35fc8c1f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321283, "uuid": "5d08ec1b-a5b1-4850-a59f-0c1b556a03e1", "comment": "Malware payload (Mirai)", "value": "6b8de0a314ab7a30edfdd755730a1eda8aa7319b2a28cca939c50a31b6da1e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321283, "uuid": "051da211-98cd-4602-a054-c481804f0de6", "comment": "Malware payload (Mirai)", "value": "60f322e76a286befd91cb89896bad9dcc5132dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321283, "uuid": "1641012a-6f59-4bf7-a81b-2d61f71a0970", "comment": "Malware payload (Mirai)", "value": "e46688355b1632b9b72d1fe7f83972ab9790cd4d3eac53aac29e06449aea17e68a2b2a4d46c4125217d8fc90a52a0898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321283, "uuid": "c90c0ae5-5c99-4873-b50a-89ef7b176934", "value": "T148445B46F68080FEC8D9D0385BFEB136D861B0AD5278B65A27C4AF163E0DE605F2DB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321283, "uuid": "a17fcba6-d164-4595-a107-1b55a1d070aa", "value": "6144:qVz3Jf1CXxkYgDofOp3n+x2u3bJiiyEcRZi7lYd:qRNbDofOx02csiyEMiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765321283, "uuid": "73711963-ef2c-4aab-b333-7d7df81701a0", "value": 254792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765321283, "uuid": "2bb06684-9ef5-4854-a1fb-28ced57f1d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321283, "uuid": "54b19f75-8e38-4133-b98d-788da93333af", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba28a95e-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252454, "uuid": "fd7952d2-a7ce-438f-989f-f3f9b462256b", "comment": "Malware payload (Mirai)", "value": "c41ed8eac6087e914d3163a1a12ca422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252454, "uuid": "290cce98-b3b4-4196-a0d5-2847a0e43912", "comment": "Malware payload (Mirai)", "value": "6c1c4c6e7ca94681c7125cf2969dd37d3815d03a2a9ea639f9aa0aa6f3abe1f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252454, "uuid": "7a405489-b5ac-452e-bad9-d21c0e830c33", "comment": "Malware payload (Mirai)", "value": "09335df2dc415f66d07434884ff306171bb87fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252454, "uuid": "609c1cec-3493-4b58-8688-bf028316ac87", "comment": "Malware payload (Mirai)", "value": "c794c9bf915c0a235e21136a99f780762e3d3781cf36f827584aa0b245a9d57a4186c48c7aab11ea14aad8498cf6dbb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252454, "uuid": "e20286ac-1419-4e78-b67e-0e4e2d93840d", "value": "T1C8D39EA7B38F1450C83646F01BCB576D2A3325014E6B9AE76C5F327E1E7B5DA180A3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252454, "uuid": "c99ba5f1-a653-4efa-bf8f-e8c22eb32925", "value": "3072:ghAQY/IR4PtTPGhGDJPDnsCoB628mV/aa1gnCz76HN+iPvq:ghAQYgaRzJPLoBt/CawCz768inq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252454, "uuid": "f462ca71-1239-40b9-adfd-af86078cffc0", "value": 141320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252454, "uuid": "58cc56b3-1699-48fb-a819-33224d18c40d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252454, "uuid": "147a0a82-90e9-4ef3-81ec-e6f7725ae86f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208327d5-d4e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765275818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765275818, "uuid": "0c45c415-fe13-4c79-8abc-cf039380268a", "comment": "Malware payload (Stealc)", "value": "68d9b0a9781ad4c9ab0608e804d2ec8a", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765275818, "uuid": "b9146a5d-f3b1-4b50-b12c-006d802808ef", "comment": "Malware payload (Stealc)", "value": "6c34999d0dca3024c0b6877d74c368fbe1a9d80df8256aa21882250de7bab85e", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765275818, "uuid": "5ab7f6f9-6032-43d8-b839-c398e2271096", "comment": "Malware payload (Stealc)", "value": "47d83bcc238c02858b0da3daafbae52e59c8955a", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765275818, "uuid": "f1567050-ddb1-4efe-bf23-a9757a174d29", "comment": "Malware payload (Stealc)", "value": "79232c3a01ca26ffe036edb64978ae0de62c49543364c2fe7320088dc2bf4049634112eacca4c2295b6c617f9211ecf2", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765275818, "uuid": "a20b86b0-35db-4497-b54e-d1eeb1f16163", "value": "T1EFA608C1F9959565C56FF1389061A210B631FC5983303EE76FE81A690A2ABC4373FB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765275818, "uuid": "2c382391-b960-4a8c-8feb-008770245234", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765275818, "uuid": "2d15b296-f629-4349-9da2-97c9808abab2", "value": "49152:KsJ2iR3oSxe9xU97vPi9INRXwKr2EO5Tk/du/XaT6V8aVMymL8F+/hKTYMTZ9OXs:pD3ouuKr2ErVu/XaTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765275818, "uuid": "341998a1-f09f-4e31-8649-973fa36295ed", "value": 10109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765275818, "uuid": "e8323efb-8f3c-4e74-a5b1-4cc82afdccc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765275818, "uuid": "9a540b76-e87b-4fc2-88fb-f39185859766", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7418d6ff-d526-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302158, "uuid": "9adbd2cd-1a0d-4378-a25a-c02203fa611d", "comment": "Malware payload (Mirai)", "value": "332cbe9d1e19b5a6fb8b23674ed9c66f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302158, "uuid": "b15a7032-21dc-4799-a6c2-422a7171b2fc", "comment": "Malware payload (Mirai)", "value": "6ccb561e2f7e50232add60823f8392547f6313715adf1778616b90e36d6012e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302158, "uuid": "86d20d9c-4355-4d1f-874c-e33a3505abe1", "comment": "Malware payload (Mirai)", "value": "25c4f87a237c22d67b3897b3ae62c2f7ecbae0bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302158, "uuid": "904bda96-720b-41a0-8fe2-e8c03b3f4987", "comment": "Malware payload (Mirai)", "value": "1e5ff46a15161e77815d41e6f29b2961094eb7a33573734d18a6502bfafd46c20c446560dac44cfaba6aa5e3ffac0ff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302158, "uuid": "c27796b3-ddfc-4858-b716-8095cbf2c1cc", "value": "T1D8455C46FF416FFBC05ECE31092EC64A10ED94A656D6562B31FCCA4CBB9D7194AC3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302158, "uuid": "2e881d3a-08fa-4c8c-8e57-a118ddb9a1c2", "value": "24576:u4xrjUAwJd2K0H1VmlmRxLjtgqL1dWQ+0T9Hrm:BrjzjKmbL1IQ+0T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302158, "uuid": "09e59438-3423-49a5-9329-9dd10245c86f", "value": 1190388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302158, "uuid": "55d7781e-8b50-49c3-aee3-bfcb81462857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302158, "uuid": "fdfdb8e2-8bac-43dc-8ca0-ee4cee841dd6", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17d5164-d495-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765239984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239984, "uuid": "ba6b5f42-ec19-4b8c-91a6-6116d93932b9", "comment": "Malware payload (Mirai)", "value": "95b985040cb15f01c2567eb95de8b77a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239984, "uuid": "32815a82-f1a6-461b-9e1d-2beb2a5adebb", "comment": "Malware payload (Mirai)", "value": "6dd85ec7536d822ef2d4221cc5671c97b928f10aec4bf59b01cc76670ba13c0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239984, "uuid": "2bb95d0d-8997-4ccb-900b-1e83450ef1d0", "comment": "Malware payload (Mirai)", "value": "e66c6672460253cd5d363d23dcc70164833b8754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239984, "uuid": "4d6b0efd-9e63-4dff-bedc-00751d7af4bb", "comment": "Malware payload (Mirai)", "value": "365455898c30c74fe226a1d16a0cb06f368122f648fddba9edaffa1cd157573070d3bf2f492793a535b17e60fd2b8045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239984, "uuid": "d7c1694c-7198-4a35-8afd-08f3a63124fa", "value": "T1E5E33C86EA409E13C4C61776FAAF514E3322E794E3DB33028D185FB43F86A9E4E57605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239984, "uuid": "58450f22-53ad-4cc5-a7a3-0f54701959c2", "value": "3072:DxRizSAt/6R54dO21MiF13bOjU1CUeY10M6NAyXap0kM/9dnr:DjizSO/6RSbQjU1CU7WMGXapnM/9dnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765239984, "uuid": "59ea4e2b-2541-4763-a1ef-4d8424abe1e1", "value": 150354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765239984, "uuid": "145aa851-d50b-4981-bd94-91bc10bf9e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239984, "uuid": "c75f0237-2637-40f6-82ed-2d578c25d17d", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eb25aa-d515-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765294935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294935, "uuid": "94e01e0d-989c-4e0a-8f68-39d441137b79", "comment": "Malware payload", "value": "4dde5dca86727878a01ca067956f4def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294935, "uuid": "bb4dbcc8-fbb0-465c-ac25-60e9c4eed576", "comment": "Malware payload", "value": "6f2478e1e12e0e2d448d4ac4d855e93c78ac654a06f300e33f66683b41d1a4ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294935, "uuid": "5e869066-548c-40b6-aa16-33ffe8e823f7", "comment": "Malware payload", "value": "bbf7617b1088273eba0a3059c139db9b50b849dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294935, "uuid": "90272980-b824-44c7-8efa-2e09a54a9de6", "comment": "Malware payload", "value": "41277618c5162f23f69ae1753da35a1834410bc6843d006480d5c778e1233361f9772668ffc8015f91804f423822a903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294935, "uuid": "3b8703a4-9ba6-4d89-b0eb-e93fff6a9404", "value": "T17683D805BB614FF7DC6FCC3B45B95B05249C960A21A83B767930E818F25F24F5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294935, "uuid": "c0f751e0-a096-4ff0-9288-6a261984fbab", "value": "1536:UAN1TIGKS/QbvhmCAAG8GnSoa6knggHpy89LmDenBK/T3bsRpS:UISGKSQYoGynGx/T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294935, "uuid": "bb752132-0b36-4889-b810-8d48c6468e60", "value": 88392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294935, "uuid": "0769fc83-401b-44c9-83d6-2c2809ab9eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294935, "uuid": "1d2e1d23-e968-4352-9a48-370438911173", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9b3c46-d506-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765288353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288353, "uuid": "7e642c74-1094-407b-8b44-1b92f2c65ec3", "comment": "Malware payload (SnakeKeylogger)", "value": "92471f0fe90a994c6d8ce7a0ea0a5682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288353, "uuid": "ac551684-4be3-413b-a542-f3672c991511", "comment": "Malware payload (SnakeKeylogger)", "value": "6fe2d4ee4f6b9c95e15e45f11b80f83c83d0837d67cf6747bcc9c0b54ccda12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288353, "uuid": "cdeabedd-01cb-4eb2-b448-8eb41dab8ce5", "comment": "Malware payload (SnakeKeylogger)", "value": "3bfe159cc6b466a67fe9fde3f6cd1e01553eae6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288353, "uuid": "a3e070b2-1823-4b6c-8cb7-7139ce0cb1a4", "comment": "Malware payload (SnakeKeylogger)", "value": "c0708864c7af770535ea06ca4475cf13316f65e82f551eacb60ad12979c717423d93d309f4337dc6b4e5e5ec7cdaa0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288353, "uuid": "77899bfd-4d64-4197-887b-b111eed3e493", "value": "T1ACA58C2297A409F4D6BAC774D5424337C6B078D99370A24B069DD5583FB3AA0AB3FB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288353, "uuid": "39e16ed5-cd42-4581-aab0-305cf4a81051", "value": "5edb8b5f08ac87b95a8820c911ffbf51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288353, "uuid": "724777d2-f62b-4443-86ee-e6ae2064fe3f", "value": "49152:xmbIJatR2nb6RshpF55JW90Oe9HL/S5VprVr21fSch4NTWe:zbRF5vI0/2VrO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765288353, "uuid": "8f300f6f-fac1-4ab1-b453-3150b7af5b6f", "value": 2260992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765288353, "uuid": "b0b9d1c7-30be-498a-92bd-649028f17e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288353, "uuid": "30ad54fe-5db1-4d1c-b989-9a688586860e", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce3fe39-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286335, "uuid": "28dfa236-7fce-41e4-92b1-2deaf81d13b3", "comment": "Malware payload", "value": "ac588b4a14ac34ab38f163b834231009", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286335, "uuid": "0359561c-41d1-4eb0-a9c0-509f7bba55a4", "comment": "Malware payload", "value": "70159add17c13c9821b3a185c82d4919d7272fc5885af8f62c984e2ed308774c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286335, "uuid": "b76ff4c8-843c-4450-adfb-41ecd4a07adb", "comment": "Malware payload", "value": "a6359565f2f78c0d884946c11224d5cf3a50a183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286335, "uuid": "c4adc6ed-5667-4c88-ac29-377df98353e9", "comment": "Malware payload", "value": "25711568746e706bd9e829a976f0e490e4998e1754d2460a5be0905690563dd4e806fd4f13abea617d30edd2f050b061", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286335, "uuid": "84e208a4-9abb-47e2-ab52-f8c998b27db5", "value": "T138661431499E4A60CC3CB389FE28A54CF37D0A3B67D35508749D41EE96B0BBD2DAD885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286335, "uuid": "8d82a05f-ebc1-41e1-ada9-67bfd6216d96", "value": "3072:FEcake3pxzUbMd0T+uHLMsudJBkdJBkslOssxdpwP0+dkeSaPuTp8iVd+uTp/eca:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286335, "uuid": "e6ac7f6e-0f8b-4e1a-9576-b3c63de8516b", "value": 6863012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286335, "uuid": "d3560e75-e709-4511-96fc-6dd49f22accd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286335, "uuid": "bd48b041-1e53-4c76-9e44-7888a37c3d87", "value": "\u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae_732735.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de90244-d4d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765268915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268915, "uuid": "6a10210e-3176-4fc0-a934-c0545c037fd9", "comment": "Malware payload", "value": "9716b0ac788103e356ec769b831328e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268915, "uuid": "6b7347cf-efb7-40f7-acc3-62cc6eb294b4", "comment": "Malware payload", "value": "7078964ebd7ca7d1b69d971536e105602377c45a585dcc56a9702fee3c36b695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268915, "uuid": "2d015fed-d881-4982-ac1e-25eff16cce87", "comment": "Malware payload", "value": "07c9d7818504ec0bac386499ead20fc3f952e196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268915, "uuid": "cf50c649-dc0c-43ec-8d89-0bdbc886c307", "comment": "Malware payload", "value": "492bf97cc29cb2fe649477111d1bfb4bdfa84c5ce5826d30b3919efd81ba6a5c83a6064eebeb942e043c2884cb70af39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268915, "uuid": "be4eb8c2-a0f8-4895-b7d6-f95171835f04", "value": "T1C0168C15B3E80079FAB79734AE799632E6727E925B31D04F0558F1460E33E918F6B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268915, "uuid": "2db9b425-a33b-4b30-a865-126bf1e7cde5", "value": "2cc8341e8866297a63501676f87ba297", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268915, "uuid": "aaedd6c1-b0b8-4868-9ea7-9742372a6752", "value": "49152:KM1nD0WMkJwBnM+mmYp+YwZOeCvvUdHiulslMJN+1NEzg49:tZfkYDwwvvUZiOslMJ0q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268915, "uuid": "27bf93b2-0439-4c94-9b50-d1e43982ed50", "value": 4331008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268915, "uuid": "64f82fba-3f2e-4a44-9d72-dddda7c21640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268915, "uuid": "b7870a49-f04e-4fa6-8c4a-d0bd3c2d5841", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3fb9db-d513-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765294224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294224, "uuid": "f4f7692c-245c-48af-9f64-ecc38a9bc399", "comment": "Malware payload", "value": "140c387a4fe62f3463b0d68624c83118", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294224, "uuid": "2ee9e95f-e31e-4475-8116-06e549f83ce2", "comment": "Malware payload", "value": "711f3c55c3712a74b5d8f6cb849d9d5af3f82d1558296b26c6bf5717335c57bf", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294224, "uuid": "bc1d7405-2f1f-4994-b628-719f8f048323", "comment": "Malware payload", "value": "cc1aa708d3c28a5600079eaf98c0f7b29549ad55", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294224, "uuid": "f189a64c-cae7-428f-bcd7-e1d756636961", "comment": "Malware payload", "value": "57a54d5e19b3bcbca96d0bf17a748a0fac4b932c01feee54bf1ed4a8b9cbce64a292297fcec4e7729223b8278ca97c22", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294224, "uuid": "a71ecba2-41b1-42d3-931a-210547dd2a28", "value": "T1F51167D313680180CB654175201BB705C769746796D2CBA993C2B941FEA55418F7DDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294224, "uuid": "66fb8e04-eaf2-40ea-9b45-862d05c7c2b1", "value": "24:8O+srXLSYsl3/NYJC2h/Vy45opDn2Dw456d0HZjRq9cpJomTzcHn3:8vWLSYsl3/NMC2h/Vh5o1Cp6aHZt803E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294224, "uuid": "b4de52ef-e6e3-4da6-bb24-b85fbd8c6e7c", "value": 962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294224, "uuid": "a8bd369a-1ad0-4efc-8106-ddff629b78ec", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294224, "uuid": "21a86edf-efea-4b1f-a898-948376d65c71", "value": "file.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7986b-d4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765272498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272498, "uuid": "2770c6c4-e743-47ef-a74e-61b96c34ded5", "comment": "Malware payload (AgentTesla)", "value": "c083158fe87dba88b6ff9219712551c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272498, "uuid": "c2b9bc27-2ad6-4f39-b8b1-70144b73c68c", "comment": "Malware payload (AgentTesla)", "value": "744d2a400217cb8db10c0164ee189fd7b7733d40ec58bf7e4e4ef9bd066c6514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272498, "uuid": "350b06e6-e3cc-4b0d-a0e5-1eb89d1c6763", "comment": "Malware payload (AgentTesla)", "value": "ed32a3b2c223b2be505749d1d981b59a2d795fd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272498, "uuid": "29e6ea9a-87a5-4a4a-a4c2-d129c5b61317", "comment": "Malware payload (AgentTesla)", "value": "fe6aa6189b87572723dceef40b7822d57a56acfdd1dbd73776d58942e2b7fbaef45757e5c109088a4b2eaae6f4741336", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272498, "uuid": "0b954bc5-e9f5-42fd-9bc5-e6d52e7efa27", "value": "T1B205F1D03A357719CEA01A35E524EEB186E52D787410BEF75AEC3B9B39AC2119D0CF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272498, "uuid": "dffd8c72-62c9-4350-83eb-677ce34a162c", "value": "12288:X8cJm86OKAX0rlsWFUhW84LZpdvM3cl9N1T9jGe0Yqg/lOIWuKKxuCBkikQs:X8dzrl7UhW5LlkKt5jh05Vo3kiNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272498, "uuid": "a5f79b55-ad57-487b-a7b2-341e42a09210", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272498, "uuid": "4d4dccb3-f91a-4aef-ad4f-b7f2a0077a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272498, "uuid": "e15d1eb2-fadd-4793-b364-15c9f47da588", "value": "Hmoc2kXKT6WnFNl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d6994e-d4eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765276847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276847, "uuid": "fc1348de-ce12-43a5-9052-0015f8e431ef", "comment": "Malware payload (Mirai)", "value": "3db2752d6477df758695ad13c1d7988d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276847, "uuid": "f101db07-143f-4148-986b-3a9942d00956", "comment": "Malware payload (Mirai)", "value": "7453139aeb76baafd24f4233bece96f5912a3de05270e1b3d4a0036289beeb55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276847, "uuid": "8f3812aa-8fbf-4541-9b77-e9a92a34aad0", "comment": "Malware payload (Mirai)", "value": "04492e1c421d6bbdcb3621eeb548cb52a5ce0b53", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276847, "uuid": "023179ad-102f-4863-a07f-d9604b0a3b82", "comment": "Malware payload (Mirai)", "value": "9548e85104616441e1dfe90921b1902a0c16513e9c654274ee92c205c8e633d48ac7d1f981b8085e72b090c12a458f53", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276847, "uuid": "a8c06cd9-1a46-4e9e-9549-6e986392c1b4", "value": "T1F411558E119874879A4CCF49B4AA85CCB6F9E9D4B0741503E6A4BCF7D0892036974FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276847, "uuid": "836fa83a-9038-4b5b-afd4-14552c465e8e", "value": "24:3J3nE53EcyNIZEtPEVKTm3E3eMLEOSMETkEH9EKPlEzcA:cxqAQmEeuSpBjPCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765276847, "uuid": "a3c60bca-9bb9-4b2b-9dc2-a8686305631b", "value": 877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765276847, "uuid": "1c49d995-bc9c-4741-9144-51f5a8e0f3b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276847, "uuid": "2b72b23a-d73b-4d1c-b094-0c913405ce10", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a150b3bb-d504-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765287631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287631, "uuid": "b86f6a00-68fa-4d6c-ac6a-23e452611fdb", "comment": "Malware payload", "value": "6f7e4a11a6f6870f7d9a999e6175af1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287631, "uuid": "67327fb4-5d3a-4257-8cb7-88ac317e8558", "comment": "Malware payload", "value": "749e69881eeb60720baf21178af7391cf71445fdeae0b5ca5bba53ca5ac0f787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287631, "uuid": "e0ecb61a-b292-4272-b58e-b2f75691e79c", "comment": "Malware payload", "value": "176386d1d3fdb0c78c1748b74e1ec85033e4185b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287631, "uuid": "6a309a38-d5dc-4bff-82f4-82bfc141742f", "comment": "Malware payload", "value": "ec6de14b47e08a6cf21d6f5c70597b3155d4709d6a24bb76d954e3feaabad5cac4d0385a169356292f3b975fd7e73c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287631, "uuid": "230341e5-9257-455c-8898-1a206c7ec230", "value": "T18FA7338DE3212A69E617427648D9192FC0CAFC9A1BB1DA85B7FC4FA2145F1D8FD78700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287631, "uuid": "b027c692-3012-4468-81d2-4e18dee009c4", "value": "f577fd743382e8e0111ec2f16ddf3361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287631, "uuid": "93424b82-7079-4e15-97ef-03f95672416e", "value": "786432:SFlUR1O79W8YLY0TXMb8YrRQ766vVFnN4AUOU3VB+7ONDrosooFiPTBYckkwgZpU:SEW79W7XTcLwvnKAMekDrZbUdYXWt4rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287631, "uuid": "e975fd84-ca65-42d0-ac5f-d409d016bbe1", "value": 45010416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287631, "uuid": "208179a0-4814-4fe9-8e47-1b8ebf3a10a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287631, "uuid": "f7905323-d5bc-421e-9a75-91c5d3222214", "value": "pdfclick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fae9ba-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298507, "uuid": "7f082c32-fbd9-47de-884c-6501d26e4f09", "comment": "Malware payload (Mirai)", "value": "b23c26ccab35f750f3ec450e71b47c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298507, "uuid": "7b2cfb67-7a06-4b0b-9991-ca9f532d0f9b", "comment": "Malware payload (Mirai)", "value": "7539ec9a466360514d8bff661246cc3ed557acde89d9ab2d1daf335e8931c713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298507, "uuid": "eef8773d-4c27-458d-b8cf-b3fc4ad88a27", "comment": "Malware payload (Mirai)", "value": "e362162b0d12dc0d9e983360dbc2371d99dd057f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298507, "uuid": "022cbb7d-09d2-4292-b342-51fb3f805c7d", "comment": "Malware payload (Mirai)", "value": "99e4a906da815751d0a51527504c46bdd8efb269fbc28ae1f8dfd17339ca9b65eeef1267cc826ec47af0e81d42a42f72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298507, "uuid": "a17eecb5-ed37-4d5f-bd2c-7d40a529f6ee", "value": "T13443C949BF608EABD8AFCC37457D8B41348C961722683B757970E418F35B14F5AE38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298507, "uuid": "427d16ee-6ea0-4f0d-8511-c2bb0a326c79", "value": "1536:7TYu1927fvBkqvvCsOCmaUVoZAKjJxqT3bsR:7PQvjlqT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298507, "uuid": "9e84a1ea-91be-4e95-9099-a0be3489a4e6", "value": 59696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298507, "uuid": "99636d98-13de-4401-ba59-abeadfae864f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298507, "uuid": "8c3efc8d-ade1-42ff-aa76-89420ee5d9ad", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088c05ca-d52c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765304554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304554, "uuid": "4f060712-62e3-48b2-9b2f-04bd5c004fbd", "comment": "Malware payload", "value": "37581a6ece5846b38356bc92a51e3193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304554, "uuid": "d747cd05-b511-42f0-bba4-e1e463a22bdb", "comment": "Malware payload", "value": "75c2b16c30b35878119775b874de1aaefb409e93384be4dcaa1c888d18499a4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304554, "uuid": "42a840a1-3e27-4984-b3be-7ce13a8b58b3", "comment": "Malware payload", "value": "cd8604dd96a33d6db71ceebe153102fcd12d4fca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304554, "uuid": "dc64687c-8818-4d95-a18c-9947b68b2ba3", "comment": "Malware payload", "value": "522399911bc5558b07b5b20882c8561361a71e0390bf9fd1adb6e633a8b1aa60f94d5ae1443456bed63d063594693ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304554, "uuid": "8dd83344-9e98-4afc-b565-e9d4e2e586c7", "value": "T195235D21FEB65C1BC4CA643B51D34335FAE64306B4ACCB2A7D710E9DBF10894261BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304554, "uuid": "c0dc8751-6149-4fac-839a-f1d0cdc29694", "value": "768:oJdZeT2ZhWgVW/fHOBrLFc7UpCRy3ajO+NlQYhHzH7LhhZB:oXZe6X/VW/fHONjCRy3aXNKYtzH7LhhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304554, "uuid": "b1ac4f19-6315-4da5-9a88-e58afdae64a8", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304554, "uuid": "dc82b2ac-a15e-4ba7-93c0-78d2f712debc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304554, "uuid": "a10b5868-991a-4941-9aba-a5c9876ee27b", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd6b84f-d504-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765287675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287675, "uuid": "3edabcb3-e6b5-4279-980e-fdb23bc2ab48", "comment": "Malware payload", "value": "6b0255d8323f717caab0672cb30a5286", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287675, "uuid": "14cbd13d-570f-454b-8f48-3337034ae26d", "comment": "Malware payload", "value": "770084c445caba3a570689148004600f8675bf6d7f0deaa45f50b258f346c1bb", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287675, "uuid": "130771b6-6c7c-4ef3-8780-936b499630b0", "comment": "Malware payload", "value": "c83c355ec1adde0185c627f98bf41699c327d3b0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287675, "uuid": "bdc3e89c-2ae7-4a8c-97da-184419f2e225", "comment": "Malware payload", "value": "7b2cef39a3bd9b63602fc166fa8fa99250a085e5cf966b80e78094828154da5e6129a57fd424c8e797b436abb2e59e5b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287675, "uuid": "8eb82a10-5193-410e-ab69-4d660b096062", "value": "T1BCC47C2AB69853F9E1A7D074C9434502EB71788A1721A6CF43E14A6B2F776F05F3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287675, "uuid": "ae952fb9-b52b-4b0f-b9fd-88833e7b6b48", "value": "14a8d351a561d22d7e7c839f92ec5eb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287675, "uuid": "426a20ec-e1dd-43fb-918d-c4d143ab5f23", "value": "6144:ZY2e9P35BpWIiscFzXaMCJdJ+9LqsuYkd7OQcsmdqLWo0N7pOZCdso1Denm4ClHe:e9fuscVX3Y+isqTZcso1ynm9lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287675, "uuid": "b177693f-6ac6-43ef-b217-a619f1cd7055", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287675, "uuid": "022c5052-6cc5-4eb4-825d-aa85d2bf7b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287675, "uuid": "24f27136-3318-4c18-99a5-873a5531a111", "value": "PDFClickUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c38589-d4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Matanbuchus)", "timestamp": 1765266745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266745, "uuid": "de43a1ab-1553-465a-8072-c3c454e83191", "comment": "Malware payload (Matanbuchus)", "value": "1ff365902d427237cf9965779ef65ad0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266745, "uuid": "7be6225c-8279-48bf-973b-1db923108b29", "comment": "Malware payload (Matanbuchus)", "value": "77a53dc757fdf381d3906ab256b74ad3cdb7628261c58a62bcc9c6ca605307ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266745, "uuid": "bfc2e751-d9ad-4756-bebc-6d6326ed0e80", "comment": "Malware payload (Matanbuchus)", "value": "cd53bfe4b85dad062121e337db4ef3e16cb3267a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266745, "uuid": "d6fd2191-7998-40ff-bafe-5787699f3870", "comment": "Malware payload (Matanbuchus)", "value": "87c70e163cb9728a08c2116544c726b105b25f5931fd33d8ff3f4326fbfc1d77e3abb3f4dcf5d6eceef48accea78eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266745, "uuid": "e242fca9-b789-46b1-b580-4d0e8ed71483", "value": "T130454B26F201E609D05B0178BB25D7AA689C3530578558D37BC2BF9E3E616F287B9F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266745, "uuid": "09e1bdc8-e052-40c9-b641-08b62e244af1", "value": "cf5cb8c86b694abd9c1ab08034eb8bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266745, "uuid": "b07e8796-8656-43fb-bff0-d20f330dddc7", "value": "24576:S2Zm93HeH5n7tDGKoORmoSVPbi7VaqKFxPTw/3kPoouW6Ds69DMfV87ZqEArCe:Se43+H5n7tiK3RmhVPb83kPfv6DsZfMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266745, "uuid": "9a3c8d28-b088-4d4d-9ba7-475c3a6b1c7f", "value": 1229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266745, "uuid": "4b051939-063d-4f52-b96b-e0794ced4506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266745, "uuid": "94562345-9b0b-4052-9096-e72ffeb96e3f", "value": "77a53dc757fdf381d3906ab256b74ad3cdb7628261c58a62bcc9c6ca605307ba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d68ce-d52c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765304727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304727, "uuid": "8430e6da-aafd-474e-b600-529237ec3880", "comment": "Malware payload (Mirai)", "value": "32bdfcdac9c9a23cbe04c5840cf2b9ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304727, "uuid": "89d2dcef-b875-4a8e-b02e-7e3577d5ef10", "comment": "Malware payload (Mirai)", "value": "78667662f402ac8b248e73de0eca46553d70937d824b7afa937238d2c4ae7146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304727, "uuid": "c715a0ec-2c53-4d7e-aecb-5479b248bda1", "comment": "Malware payload (Mirai)", "value": "2827e8f695f9d9a2703c00be3a20e99252c4a1e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304727, "uuid": "c2375ecf-8eee-444a-86f0-196ab9583334", "comment": "Malware payload (Mirai)", "value": "16d4780d8eb9572a4bc849aa11c493d27b66b579cf5bb80071da79c40822865f2b82bb5e0741eaf13e1bbcdff7d76b71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304727, "uuid": "52c890aa-9d30-4d30-8540-e29e18cd5f59", "value": "T1B4B31205B4DF2A43CDB864F1B01A842F7AF08FE5965B359360A76947B66380832BD0DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304727, "uuid": "87043f92-60de-4807-890d-9b0ae93df362", "value": "3072:5u36VEafOAaMKaPLD5qmDxO2g0GmU6kbDs0lmPQJLsek4MC6bdALP:mqW9KPLdq6xO2QmDy1lFLse3MC+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304727, "uuid": "6e983158-90d2-480c-8353-9058dab4fb90", "value": 113812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304727, "uuid": "8def55ed-783e-4fed-8292-67d6a00c6f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304727, "uuid": "11435fff-b42a-4981-a8dd-db4ed07012bb", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098a4cbb-d496-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765240131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240131, "uuid": "011564ab-50f9-4ba0-85c7-7c52340f0e3e", "comment": "Malware payload (Stealc)", "value": "378bbbd6e1c911534ffcb7705ebe1053", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240131, "uuid": "0d3dde1e-6f69-4ce0-9676-9f38705da360", "comment": "Malware payload (Stealc)", "value": "78ab55c2dd38e05f9a0e198875adea3d6a93fc3ec68cf5c22759e5f1e4468620", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240131, "uuid": "86dc26de-5139-426e-ae99-b384852a1122", "comment": "Malware payload (Stealc)", "value": "88579b742c18550d140c7efeb78a5b05eea62a81", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240131, "uuid": "f707f332-363a-48b1-bc56-9680a0635e0a", "comment": "Malware payload (Stealc)", "value": "2ffe2c0e377f415623b0c3a595ba77840e3c0cf670bedacce6ff2a366c1d23067dde32db8be0ef46d5d46f1b28d32022", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240131, "uuid": "76f2bd3a-1025-493c-9bdc-d6797b1fc6fa", "value": "T158960881B9954E79C66BF13C956062217E707C1A43307AD36FE81A6D4C3AAC4273EF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240131, "uuid": "d4bbef4d-52e7-4370-ba3a-220c1a70d122", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240131, "uuid": "053c4314-3b0f-4ec7-988f-797d8c10ea34", "value": "49152:VqlMgR3XPlhWVKE+1Gc7HDtPwHbjjUb58ob+GR2oetwvm/o5:U3bE/cn2Hbfi58obFMdtwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765240131, "uuid": "3518f0b7-a2b0-4ec2-a4ed-f2d5713f790e", "value": 9101952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765240131, "uuid": "64eda2b1-c1dc-43ce-87fc-49a2292ba977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240131, "uuid": "fbf5286f-7aab-41a7-b89a-c62399767048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e7bf9d-d545-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765315468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315468, "uuid": "eac29dbc-c2df-4eee-a93f-c2bdfd468396", "comment": "Malware payload", "value": "82adec72e5647afee39412bfbcbed71f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315468, "uuid": "a77135cc-f2c2-4d5a-9e6e-43eb52b1dcbf", "comment": "Malware payload", "value": "79192cba1c7037e1fe15dbf50bb2b3a96e53a85fbcbd2ce229af0efacdcb73c7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315468, "uuid": "5fd47991-af87-4ab7-8717-59683dd9c4ba", "comment": "Malware payload", "value": "cc6d561855e59fb2ea4a54af755156a8fa15944d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315468, "uuid": "4f4d1a68-9af5-4be9-9fd2-df45423254ca", "comment": "Malware payload", "value": "8b65795b304290ea71c9a4670c15e69084c20340e7871c9416567a1fb44827ca9f21200a0ed58b562e23f2426a79b888", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315468, "uuid": "5f4ce4c9-3cb9-4774-abec-e7cefee92b8d", "value": "T11D919F1417E50224F3F75F7D68FA62615C3A7D9EEE218D9D01A0D1880C61A25ECB6F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315468, "uuid": "f5ba6f85-5c8a-45c2-a668-1a58edaf5004", "value": "96:8orXYOx39zkJWTXzkedKzkFISyosJY1um3YLq:8orXYWNQJWTXQpQofY1jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765315468, "uuid": "74c659ce-a463-4470-be2e-807881ac59aa", "value": 4240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765315468, "uuid": "1772773f-6e7e-4f78-9634-0daaea2cf88f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315468, "uuid": "0d1bd7c3-c9a7-4272-b510-23a57019e256", "value": "Suspected_Internal_Fraud.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a42f59c-d525-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765301631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301631, "uuid": "c2ee62fc-ad8a-44d9-a1d2-228f546b3426", "comment": "Malware payload (Mirai)", "value": "ac072550ec38087add64346a24a06a38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301631, "uuid": "261530b3-ccc6-45e1-91eb-6bbd405c7cec", "comment": "Malware payload (Mirai)", "value": "798bf0bba7a22707557a27f5fcd7f1717cd12fe4bda53510ed459cfe71cca337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301631, "uuid": "7c45c851-8a9b-4a27-966f-30fb718e04bf", "comment": "Malware payload (Mirai)", "value": "633b75a04db2d370c07dce6814ab64cc20bb81dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301631, "uuid": "1c794159-96ce-4e93-9cd9-ff46c405f7f6", "comment": "Malware payload (Mirai)", "value": "46d857308b5c2e68e51e21cdab93cd8c853b8bb4d98d563f75a1d00eda8835a359332d6a9e94991adf5a92e52b1001a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301631, "uuid": "9ee62732-7025-4b5b-9455-cb4c592e8510", "value": "T126556B43FB1C4432C8530EF01D7F07D5F3247A4251B5A62A6B1A9B6B2622F35EAC735A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301631, "uuid": "0d6ba49f-858a-4e1c-a6fe-9911ff5ed5b1", "value": "24576:k4HBYM8mE9pOCiqzy3gtM4IFCjWqdP7Jh+TLvQbQkfQQ6B8Uwfu4/Jn/G4yZX:k4HBYMbE9pOCiqzywe4KCXd9h+/vQbQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301631, "uuid": "df82a525-dfe7-4a1e-89e8-fcb168dbb56b", "value": 1317452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301631, "uuid": "06255ae8-5343-4d67-aa87-97b23c0d2f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301631, "uuid": "f8bf4d18-160c-42e6-8c65-0890cf459916", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30bee01-d4c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765261461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261461, "uuid": "6ebc9318-7e2e-41a2-ad48-a251805afb22", "comment": "Malware payload (Socks5Systemz)", "value": "fa0c8f09067f1abd78d5501b89cb37e7", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261461, "uuid": "34b92dbd-ff05-403a-8858-9f00ee2050ce", "comment": "Malware payload (Socks5Systemz)", "value": "799349aa1eafe153eab0204fac20c82747f9f3838c354ab9b84fa39a612da058", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261461, "uuid": "e4c536a4-2ab8-46a9-a51b-7351f9b7cfd8", "comment": "Malware payload (Socks5Systemz)", "value": "3f5aec349b20fdba5d53b9e37135a85cd63bf6e0", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765261461, "uuid": "0e785403-b715-4a24-9f13-bd5a671a0465", "comment": "Malware payload (Socks5Systemz)", "value": "49714438efe9e6c27ecc0e6d91fc77fc3b995ef68b25d91521db2b9a1161e38f3107603fa521f9b45df71bde843f8103", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261461, "uuid": "0f808ff6-43a2-487f-8cbd-63957c518f6c", "value": "T128F533C1C5CE903AC0F186F59A59A468E96638C33EAD5524710FE8CC5BFFAC18845F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261461, "uuid": "235f83de-17c2-431a-92b0-5df36b0ff6e8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261461, "uuid": "0fe165ad-fb8d-4342-804b-c645ec78cba9", "value": "98304:MHyFbPfJLRmg79AGTs+Xsz0JofQgTJ9I9W:jHZRmms+XL+fQgQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765261461, "uuid": "a83989fc-efd2-422d-8833-07d2919303df", "value": 3582188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765261461, "uuid": "ca9de3e8-79a8-4718-9046-af0230d0f1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765261461, "uuid": "63f9faf2-6448-4a61-ab98-265e32157448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223db8e6-d52e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765305456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305456, "uuid": "806fe46a-2eeb-4eee-aa37-aca124cbef1a", "comment": "Malware payload", "value": "81476dc1f9ad89984a5820ea569210da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305456, "uuid": "34939db3-bde5-4925-ac97-8064d2ff21cc", "comment": "Malware payload", "value": "79d47d30086c6f41fb4307e0090aa5e47c83e5cd482ef6ed0ca5896010ba3192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305456, "uuid": "7e5bd2a6-6f9c-40f7-be11-1f2186131eaf", "comment": "Malware payload", "value": "fc48742af6b9d384dcb46bc4b3d68882deded9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305456, "uuid": "662ea4bb-ff1a-448f-a5ea-b5ab7e2c5b2e", "comment": "Malware payload", "value": "91558d671eef17dfeb9ac3b251b4a85f1d535ca1297470ce2044bd2280a7f352f022922db80951ec95d2072e1ce49b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305456, "uuid": "763ca6ac-5fdf-4992-9f84-5262cf601b37", "value": "T1E6230993B804ED7DF8C9E73AC91A4E00B061BA1942610623F375FE67DD762889C2DD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305456, "uuid": "cf201a10-5a3f-44e3-8bef-5b05ee29cf02", "value": "768:7VaSBEsZXZEwxAfILFlugggggLvBvyVTAOi8uz4vuE0/qVpneAY5bv73yPlwP:R2GXZEqAALqgggggLvBvyJpi8uz4f0/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765305456, "uuid": "7732680f-33df-4225-8210-d10205ec8358", "value": 46908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765305456, "uuid": "301f0162-14ac-4de6-a417-d6e19fcc4556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305456, "uuid": "5224135f-b8e9-483f-a62f-0894d4995f81", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b8ce2-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765264403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264403, "uuid": "9b0a3678-8c1f-4f37-8dd0-61388c814ec8", "comment": "Malware payload", "value": "6b698e95f602c53fa682296e5679b991", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264403, "uuid": "094a71c9-0440-4d7e-965f-5a15553525da", "comment": "Malware payload", "value": "7b167d362a9282adb176095be2e5bd4692b4158b7bdf4c6c20870daed5b04665", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264403, "uuid": "857e1d4f-624f-48e4-ae14-78e864d32a35", "comment": "Malware payload", "value": "e6372952b021a6d159de9f5eb3870f672f7a42b3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264403, "uuid": "31fcbbde-0ec8-4474-9ddc-287a0b3fe753", "comment": "Malware payload", "value": "ef0e35cc3aafddc2cb022b5d32ef4ecd83990fe844c004317f0c40375c34b5e6c3c80e9a050f1d3e0e8de1d6102ff7f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264403, "uuid": "322a1da4-3c7a-49ea-b0a3-fa89616b6475", "value": "T1D5761203F74E492ECED2BA781993137156156CAC1960928F4902F318BEB73E9AF16FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264403, "uuid": "07d70ef9-3c23-4c44-8391-af698047b181", "value": "196608:whN3nAQ7j9kixuhA57I9iKyBa9MAPFEuPNVexI:whTn9kix4A57AiKyInCq+xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264403, "uuid": "b3714fbe-cf86-44c3-bb07-7271bb12f95e", "value": 7644425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264403, "uuid": "9edaafa5-2139-4b13-a4d7-9b3e5661afa5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264403, "uuid": "f0a298ca-0752-4897-ad50-ad4f67ec5360", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00fcffa-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765286850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286850, "uuid": "49de7dde-6742-4dd7-a3b4-6846613e2528", "comment": "Malware payload (PureLogsStealer)", "value": "7cfe59511e4f8160bff0c2db0d6e5348", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286850, "uuid": "3f925aa8-f6cc-43ae-aa19-867ebd2b3458", "comment": "Malware payload (PureLogsStealer)", "value": "7bdded2fd3355ef7989c57ebe91836623592e21ef1d7b9c644fb673e7b792ec3", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286850, "uuid": "79a99f3c-3418-4094-8c00-a053c672e5cf", "comment": "Malware payload (PureLogsStealer)", "value": "0022ab3624b856a438c272ae2b15e8efe4555e4b", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286850, "uuid": "f8861d64-e543-469b-825a-01e208b674de", "comment": "Malware payload (PureLogsStealer)", "value": "32611f291fd1f81c0a990a846e2346ce14cc2dbdb062ab755c2578497c7b7dd7ba9d83f032762e8e08459d729c046622", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286850, "uuid": "d5717a19-4f90-4955-a6a8-c25ea370c9ae", "value": "T12975F8A64D563FEE434613F87E6F86CDC1AE412FA81D5DC4A4D4AFE92C93F30061819A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286850, "uuid": "3c87ddbe-d45c-428a-baf5-289fe4cdda21", "value": "3072:AVYeSyDA/Pc9GiZ3iNUnKat/+e+p8fcEGHuGk+/W4rr6xHq:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286850, "uuid": "40a01949-cf77-4aff-b95d-7626f000f00d", "value": 1636754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286850, "uuid": "378b2aeb-c50c-4b81-b962-8f5bfe411053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286850, "uuid": "c2f0676f-b883-4d47-bcc3-1b1a92c89c04", "value": "LPO 25-001503.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1a7f82-d51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299027, "uuid": "9c75d2e4-7023-44e2-b216-aedcf760c125", "comment": "Malware payload (Mirai)", "value": "d9f2325616e135a72592b0dc7961205f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299027, "uuid": "ee7ef82c-28f4-4564-9d31-577edbd68e20", "comment": "Malware payload (Mirai)", "value": "7bf42318828b236550be95926246dd5d08f7fd90daf8d3b083f8fad3ff637cbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299027, "uuid": "7d5d281e-7340-4a01-afc0-55032edc2f59", "comment": "Malware payload (Mirai)", "value": "41d0de958c280ff28790fc1aa095c05495f5be98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299027, "uuid": "771ecd87-9929-466e-a5b4-d7cea3206c16", "comment": "Malware payload (Mirai)", "value": "516ad8fb7086f5d8097a982f4b2dde59899abb9e2be79bd7e5f0c6ecce3a443ec8ffcefebe519858b2ac683a1a00296d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299027, "uuid": "afe43b5b-8220-4e0b-9def-072e52743ef0", "value": "T1894329C5A653E8F9EC4A29741573F7325B71E8750129FA83DF99FA327C02701A50A2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299027, "uuid": "5c2feee9-4c0a-44a5-bf30-e700dfb43aed", "value": "1536:+Nm9YA0MNbBZQ8G6FwSzZKmv/OXKBhZS/Hk7ImUmQRJ:+Nm50MN9ZK6FwXmv/OeI/HA/Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299027, "uuid": "d555c387-91b8-4a44-8b8e-16525db52fed", "value": 60308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299027, "uuid": "c899bae5-4404-453b-aa28-4fd3c71c7f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299027, "uuid": "dd64b52f-7596-4d73-a9df-8733690b563b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7426ce72-d503-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765287125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287125, "uuid": "183b5085-ddc7-4f19-a244-10f246b4f88d", "comment": "Malware payload (a310Logger)", "value": "6e48946e105c112e1ea3d4ec06d6bf11", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287125, "uuid": "9b9da13c-f7e9-4c2f-8dd0-8c4ee1f7430c", "comment": "Malware payload (a310Logger)", "value": "7c2fde43badb342fb97cffd0c5afad76644568aedba9c8294446c25de0885b2e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287125, "uuid": "ac58f854-81d3-4006-b5cf-01370ca59b9f", "comment": "Malware payload (a310Logger)", "value": "d7954a6c3bc60281793806b3c854d9408da16b4b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287125, "uuid": "b64b1a71-f6b4-430c-8889-74497ffe14fb", "comment": "Malware payload (a310Logger)", "value": "4b54befd677e3eda668c2b054539c84cd497c3e7d22d9362538a78af2a0f1f7a62ab333b04992b96bf1334a4924d2029", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287125, "uuid": "01870d51-c731-4822-b58f-b35063c13cd7", "value": "T1E8C5B35D84B05CD26024FE74F685FB978CEA53851A2B47520FE495963212C83FFBB3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287125, "uuid": "e7027f7a-d3b4-4ad5-afe4-34d86d5cb69d", "value": "24576:ERXJoWBaBjo0lmO7uvC9RqgSl2P6HsVmPex8oa0Pss3Jm/AtRTntvZ7l:cg3V7Bm/Svv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287125, "uuid": "590789c6-fc16-4fbb-933b-3ef2cf068235", "value": 2690000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287125, "uuid": "58269245-b4c9-4d38-aad0-61a3226562ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287125, "uuid": "80d2fa85-e40e-4266-b504-e22657eadac1", "value": "APPOINTMENT FOR PARADIP - DA DESK.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba61919-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765307727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307727, "uuid": "d90d12b3-8c1f-42d7-aaa4-311762dd1718", "comment": "Malware payload (Mirai)", "value": "606c704cb7b95bd35e2ec805fd8da7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307727, "uuid": "226be092-7842-4140-8430-f32e10c72517", "comment": "Malware payload (Mirai)", "value": "7c8f42579d01aef5e4bbf1a34ef6c701cbaf5f54a256e92bec3cad3aac81bb69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307727, "uuid": "476c2c37-dd48-4c0d-b5b6-f5cfd1b37ce8", "comment": "Malware payload (Mirai)", "value": "80f2425da04c774f40b9e3fd6f590b2cb7faa88f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307727, "uuid": "56e19627-d898-45a0-83e7-5da7c1f1d963", "comment": "Malware payload (Mirai)", "value": "63bb5ab2b5de84b51340ec49128d19cff8bc6fc5efed56456efa26a73a1060c9591c58c2bef9948faaa3a223e27f561a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307727, "uuid": "fe760540-bdde-46d0-af53-31eb3c48db89", "value": "T163831256AB623B94FD3FAD915D62D0E82FCA2D1F2367ACC2D3C64B00A40B91DDF04945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307727, "uuid": "28c4b089-4d6b-48da-ab4e-f1b06a6efb13", "value": "1536:ybJCyW+bKQ0846YYD2fncDLX2/hQX/zgE6h6dFLOZ8kztQK8VXX7MGy4u+qgw09s:ybcWbjUYqfncDq/u/zgEWMF88mtQK8d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307727, "uuid": "9f48f7c3-8bea-43f0-a1dd-3cab7fa00ebe", "value": 82316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307727, "uuid": "9700f340-bc07-470b-be43-45db617075ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307727, "uuid": "2edb3c35-b2e8-4c2d-be7c-2bfba34ca51d", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e7740d-d4df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765271661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271661, "uuid": "155b38c8-dfcd-41d9-ba73-ad44254e7564", "comment": "Malware payload", "value": "9291209260abd02fed26887eccd7120f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271661, "uuid": "feee1f42-479d-4d41-80c3-e7faeb2bb0ba", "comment": "Malware payload", "value": "7d0c328302ff3e8a56a4a91e7bc385772d18262eb37ff6502c7c9f5cbeb38e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271661, "uuid": "51b11ad6-8f1c-4357-ae86-6f0b60f442ac", "comment": "Malware payload", "value": "f28cb041d5c101931c3eb435499c5d5a08781a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271661, "uuid": "44bbde54-086b-403d-b97d-6ff4d5ce30ed", "comment": "Malware payload", "value": "76f2871c76746754bcab0fae28ca7e002508064212ae07d7932e184679c98c39c51ca83a3b30ece387520da39ae47f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271661, "uuid": "2c55c725-a58a-4555-8ade-9040ccfc6a81", "value": "T1D3087B4263EA04C4F9F7DA759AE65617C673BC122F3095CF221C17291F736E08A76B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271661, "uuid": "b3f12996-03ef-4f39-aaea-3a4cb8e76867", "value": "56c2f8c966897cdb64954ebc4c75c126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271661, "uuid": "5cd34c2d-4d9a-4736-a7cd-c5bda089ee33", "value": "393216:ttbu6uPZI7nqYAERCJbE81AKlkUiB0uu+sIyNOnS0B4AycWMCYDMbLbTOwEJ7eVL:tYNrgsJYUKY6Shrsxwbvey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765271661, "uuid": "197e2f63-6539-4ef1-a50b-4067e058f5b5", "value": 83175626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765271661, "uuid": "dc72eb9a-e979-43a7-8041-0c35e3a38fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271661, "uuid": "d07d6d56-facb-4d2c-b2c0-5b774c91efed", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299bf542-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300315, "uuid": "67534606-39f3-4c9c-b74e-ad0d68d6a589", "comment": "Malware payload (Mirai)", "value": "fbb404b1c4aa0bd946c4301aa114f4bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300315, "uuid": "15c7fb74-83b6-4944-aee0-9a1df21d6a42", "comment": "Malware payload (Mirai)", "value": "7d4ad8f64fb1bdf1bbd7a2bd9f964701f4bf13f27f94ca3babbd6d55215296af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300315, "uuid": "59c5b348-36ea-432f-bdf3-d4a1e0009477", "comment": "Malware payload (Mirai)", "value": "214cc878dc00612e528a4f552b06e67452b2d610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300315, "uuid": "338c16be-f158-4cb1-89a3-0a5a3d6b6adc", "comment": "Malware payload (Mirai)", "value": "8f4736616375de43d2a4b8ad72768b9203da9b33a501d7fde8df4748255c41ff08b4da16e361921fd4baf0fec9eebb5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300315, "uuid": "f77e68d7-9f89-4ad1-b331-e5905aa44b5e", "value": "T14C635C22BA7D6D1BC4C4A47B21E34334F1E6570A66F8CA6E7D720E4EFF106542107AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300315, "uuid": "9ee35431-7b1b-42a1-ab70-7c2545f469db", "value": "1536:bUh7SRBM4goe3BRycbZerYVWEjYH9niI/NsIwEODzH7Lhr:b8+BDen9JIZmIwEQzHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300315, "uuid": "d5bbe6c3-3a30-430b-ba87-20296dfb62fb", "value": 69544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300315, "uuid": "9b0ff7a7-c062-4575-98c5-d6d7ebdeef3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300315, "uuid": "277f5390-911a-4585-9b1e-9b8dd71aa1a1", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fb541d-d4e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765274811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274811, "uuid": "d9668f2b-8ad2-42ea-9cd3-221c6d45fb8b", "comment": "Malware payload (AgentTesla)", "value": "58347602e2764dc004ee3df8701809d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274811, "uuid": "add16b89-0910-485a-ba26-6aae90e5d73b", "comment": "Malware payload (AgentTesla)", "value": "7fac1caf11e2ae690709ae3fca9b0b37c8201db12b62ebfa8835e8c28874edd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274811, "uuid": "033adea6-5d88-4b75-a1b6-8a70e0f06b40", "comment": "Malware payload (AgentTesla)", "value": "007c92512fa3b049f4457eb4835f9d7405ce163d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274811, "uuid": "5ffc678f-6bec-4d05-b8c7-c8b6ac1c5917", "comment": "Malware payload (AgentTesla)", "value": "20ee3d6d66b0e170ebd3383aecd27c32ed1070e65ad0efe0eb605e9bbb01b42fbf6b91ed7143fb4dd92227a17dce6db7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274811, "uuid": "4b485f19-1818-47c2-9f5e-7d827dcc4603", "value": "T105E45C30DE3402694F4B1BDAFDA50A618ABD861D463694F1F2DD030E610A5FCE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274811, "uuid": "35ab411c-1ea7-4b0f-9f40-b903e2486f42", "value": "6144:/w1nKw1Qwbwywrw19w1Iw1qw13w1Hw+w1Q+w1/9w1d1M:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765274811, "uuid": "a15bfc4b-9ec5-4e1d-9ead-97023bc18d1e", "value": 719278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765274811, "uuid": "b43a13fd-d2ce-46b9-accc-d701b5a27510", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274811, "uuid": "e6127b09-bba0-4751-8d49-cc6b74d7490e", "value": "dsada.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dc8eae-d4d3-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765266398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266398, "uuid": "1a913267-def7-4c1a-9cc1-d1240ce63c43", "comment": "Malware payload (NetSupport)", "value": "b5cfeae5173f2abf3bbb7cdb5fd31a38", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266398, "uuid": "7ba55003-0484-4b46-bf91-86aafdb210ca", "comment": "Malware payload (NetSupport)", "value": "80fdfb1c4febba8b5494cd917c61ae730dfe273c32b1434971ade25d668216c0", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266398, "uuid": "f2749278-2916-44e7-8e6d-a493b8e98c48", "comment": "Malware payload (NetSupport)", "value": "faf4c99c8809ceb5b3f43dd7ba4600a4e70cae85", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266398, "uuid": "df5b18d1-f77b-4e04-b84e-848238292b0f", "comment": "Malware payload (NetSupport)", "value": "b54006cfdcbdaccf47f15e2fce5d41eff0ce907bcbd09161ed8f2f8d8993b9a76bf842a534e494c2b8b5cd75a5272ea7", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266398, "uuid": "aec55aea-1329-49a7-805e-95cec9b9a8a6", "value": "T12472C036F308699BC4E5C43A1DFD354652F2C81D22B6739C7522C108A57AFB680EF60B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266398, "uuid": "61fdf572-3e26-4a0d-b626-5edba550451d", "value": "384:XsCYEe35gfQDnNQ1lYOYWY9Z1TeghW2Joevrc4O/1jAt:cCYZJgyNQ1WVj1bhZzgct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266398, "uuid": "b0df7c0b-b0c6-4114-af65-b67a79e2bd5c", "value": 17179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266398, "uuid": "effda32d-1f2e-465d-ac0c-2ca1edceeedc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266398, "uuid": "ca0c56d6-a7a4-4773-b28e-e0733efab005", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e9cc30-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264410, "uuid": "234a2524-fabf-41aa-8cb7-9637d7e786b6", "comment": "Malware payload (Mirai)", "value": "9b232b7a3e2545e292b2bb3c2648ceac", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264410, "uuid": "7d06d7c9-c628-4529-9b9b-db24f9015f94", "comment": "Malware payload (Mirai)", "value": "810e081cc92c3e52467c61be6a41dc15e6b997d21b7e4cf5f96570bb37207db1", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264410, "uuid": "babb66f4-5bc6-4737-842c-4bea02e5312d", "comment": "Malware payload (Mirai)", "value": "fd56baed227c549cfc93c2dd16230955c216c174", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264410, "uuid": "365dc8ce-62e7-4052-ab30-a7bf1a1cb93b", "comment": "Malware payload (Mirai)", "value": "41e0dae2670f9f05ecaf15f41c3f39ea7cc4256dec2a115afa9b96566b873778883daba8759456596ca570d30b6dd0d2", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264410, "uuid": "da0eda5d-374d-4ea4-9d23-afdc6f2031c7", "value": "T10ED44906F8809F62C5D12676F75F8268732347B9D3EBB20699184B343BD792F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264410, "uuid": "eaa40ce7-fd73-47b0-9416-1677113c55c6", "value": "12288:bDMckXrlRes6QgOP4On4ckbNpPzhBPtOzFx8prPxfI6+E8X89:bDArlReY4ElkbPzgMO6/8X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264410, "uuid": "d7438089-1f9e-421e-9aed-35096cb46034", "value": 651924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264410, "uuid": "9c1eb2d7-ac97-4151-a6ab-9c8ef17d6604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264410, "uuid": "8545676d-8864-40a5-b251-37dbab3afb7d", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513006a6-d4e5-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765274182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274182, "uuid": "d8dc1424-4a14-46a2-93c0-6c00ac4166ba", "comment": "Malware payload (MaskGramStealer)", "value": "535a9b870f9ef872b6ed8fef3beab8da", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274182, "uuid": "5a548a5e-fca3-4282-aa89-41b6ea9c5719", "comment": "Malware payload (MaskGramStealer)", "value": "8201551520d88da852863c340230da37feff7e3f0a99d983c29baf315af37a49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274182, "uuid": "901f5b52-6448-447c-845d-45532cb9962e", "comment": "Malware payload (MaskGramStealer)", "value": "c4664dbbce504b538c4ac0706d690916283c47d5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765274182, "uuid": "7411eb3e-ae37-4b3a-a1e3-3dcc324a4121", "comment": "Malware payload (MaskGramStealer)", "value": "2bf11ed3009c7cb2d7861cb2783641416b538795fa4fb9b749e243c366d1ee422b6ba988e011f52f9be35257028d1f6e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274182, "uuid": "ff901fc0-ecfe-474c-a95c-473b1e76083a", "value": "T17CE36C97C98184F4D82AD4B8CADBE22F29B6B491403D754F5EE09F061E72B70F31DA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274182, "uuid": "2449b306-c46d-45cd-8294-13ea0a5b3c08", "value": "dd5eaf09d8623688596c2c73b0c03622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274182, "uuid": "2c05c455-64df-4b1b-9417-db9d37c68a67", "value": "3072:ziXQVtISLKXDsBwl/Fx/SBzEHeZuTP3weln3NKgkwfwgS5/8V90INA:zYQVtIWKDsBwl/FxYzEHSuIeJEgqKV9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765274182, "uuid": "b64b8d77-37ba-4879-9881-0afa53f34e1d", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765274182, "uuid": "31cf721f-00f3-4f5a-a210-2aa90590b629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765274182, "uuid": "c13c51ba-4f6a-4d71-9e94-aebcae93c4b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5374cc0-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765286053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286053, "uuid": "ba746dc0-68f2-476b-b35a-21caa34b0574", "comment": "Malware payload (DonutLoader)", "value": "32f01f0037c4d3ac1878bb88e0ea4a9e", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286053, "uuid": "edad6bef-e645-4095-8c40-985f7ac27719", "comment": "Malware payload (DonutLoader)", "value": "8215acc9f86972430a1f38c8c48fade401cff567f63077bb92f478c0880a7283", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286053, "uuid": "c049ea4a-0f7d-4d39-ab99-8a753d01df52", "comment": "Malware payload (DonutLoader)", "value": "9b16998bb87e0566e2c7c9f8fd11d647d3287153", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286053, "uuid": "85272f51-5dfc-45a6-abe1-5280a757d295", "comment": "Malware payload (DonutLoader)", "value": "d351eacb713e68fb38f5f5f658088473a6de4b2ff5d01908d4c27ac1be90c173ac929ae1f8a942269b5c9809a1856e8f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286053, "uuid": "eb850d17-7e22-4ffd-aec5-b32423d6c022", "value": "T1984694240FE4B18E6AF754BDD81EA5A4BC6D663371E11D0E363AF257B43A80C7810E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286053, "uuid": "534d6fde-750b-4a9e-985b-dfe0e8baeaf2", "value": "98304:sUUJROJZwPSOibdFogJLmLPM37GcF7m/0ojQugdqSajLT7A87NSVxx3SRKiaEIO+:sUUJosi5Fog4LPM37GcF7m/PydqSajLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286053, "uuid": "3f7fb6f6-b7e5-402a-b236-1a119354d407", "value": 5774789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286053, "uuid": "f0166fe9-dbe5-43ad-8047-e7e10dddf976", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286053, "uuid": "51702113-3207-4c6e-9403-d8146e06cb82", "value": "Quote-RFQ2025.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa9d57-d4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1765251814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765251814, "uuid": "46dac19e-1103-4980-8a9b-d029180977ca", "comment": "Malware payload (Kamasers)", "value": "5e2ad7b633183027484f828e9ade3804", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765251814, "uuid": "731c51a1-30b3-4dac-9194-fc6bf95d7cb8", "comment": "Malware payload (Kamasers)", "value": "82d8b986e2f7d6c4a69341087a88d200dc860365f038d166e8c4ea79568bc267", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765251814, "uuid": "ad524e6e-99e0-4fb7-91a7-4070aa2d2f0e", "comment": "Malware payload (Kamasers)", "value": "f20928749440e03e5a538d4d6ef03e8fed0295ca", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765251814, "uuid": "4c9c2dc9-9355-4112-b249-7e2fcfd1174b", "comment": "Malware payload (Kamasers)", "value": "abfc3c0748e6931cb790639610dbdcfb4b04878e3599db2ba022cae15e280d9eb7852b1b43bbffafb6fb964bed08bf60", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765251814, "uuid": "a349c5c3-3bfb-4c39-8ca9-c2a8c4a9359f", "value": "T15F952303AFCCE997D6691B7448FA43BB27756CD41D3693035236AD687EB3AC07860B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765251814, "uuid": "b78f1163-98f2-45b5-98cb-3b55168c0cfb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765251814, "uuid": "de5deac3-5a28-40c1-a5ba-48357660008d", "value": "24576:xy+t3WQkIuG184/hiAvq91+8ddmAykn/tquVmXNNK0+pY3yepX34bfQK/k2:k+t3H9hy4vqG8V/ttKYpZepX3pK/k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765251814, "uuid": "3fc5afbf-4138-4ca8-823d-58bf5e5786fd", "value": 1911296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765251814, "uuid": "24e5c787-3f38-4d28-8636-704d88c0de5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765251814, "uuid": "dca04085-a7bc-436e-bd22-3dffec6433ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587604b4-d4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765281495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765281495, "uuid": "98df6fa3-6b96-445a-b3eb-f79c7cce95c5", "comment": "Malware payload (Mirai)", "value": "6644bc1e306e65689f79353d5018caa8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765281495, "uuid": "6cd1f708-3806-498c-bdbd-3c988f4b299c", "comment": "Malware payload (Mirai)", "value": "8346ac3b9e7b30b788c583be8d16a776c8383972a31fc8b04fac4a7b6f3d6b31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765281495, "uuid": "7cf6f95b-4b1e-4cfa-8823-d50c7cb24b8b", "comment": "Malware payload (Mirai)", "value": "d1863a725e7be00b64b11bcf502d362c9fd6f6d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765281495, "uuid": "308897f9-4027-4f53-8cc1-5ff7a6d7e91d", "comment": "Malware payload (Mirai)", "value": "fa0a7125af004f4d762e772c1382c8b54eb3e84a974c643b38cf9becb3229d64d335f6a730925fd27723017546a76945", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765281495, "uuid": "a141aac8-32a4-4ec0-a918-1eaabfcf1520", "value": "T14C11A1BD42096578408EE816B1A2C70878BB8BDF34B7AA506D65723860F05DE3032F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765281495, "uuid": "b19ba935-a69a-4475-9eab-e8d408a599a7", "value": "24:tgvVZffVZWVZFVZsRpVZZVZ5SVZ4SVZDVZyvVZQJVL:6VdV4VvVevVvVOVpVFV4vV2VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765281495, "uuid": "9f7e21c0-c15c-451d-812e-24577ff656b8", "value": 873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765281495, "uuid": "855e27b9-7474-48f1-9d35-3057677aae08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765281495, "uuid": "5e2a3c09-b411-40ee-ab3d-b4f15d6fde8a", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce73eb49-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765286847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286847, "uuid": "93643c6b-c2e3-4157-972b-e9454bb1f695", "comment": "Malware payload (Formbook)", "value": "2229db5348609aa81a208ae649c8228d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286847, "uuid": "8bd08180-de64-404a-8343-1e796c8afd29", "comment": "Malware payload (Formbook)", "value": "8500af1eca42ec5b7e8f4bee92fde8f6e168b0254728fba71a27e7fc79fb708e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286847, "uuid": "b28d7d5d-ad19-43a6-9d4f-46acc6637a17", "comment": "Malware payload (Formbook)", "value": "2c9e3be77058162502ebc5ba82724ca1e1668908", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286847, "uuid": "b8e036ad-066d-4ba1-beea-ed1598ee8266", "comment": "Malware payload (Formbook)", "value": "e41fb53cfd67be787ec4fbe2646e38fffb009024dc821d09905fffa0d676314f9970e489ec7aa3de0a7e604d70180504", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286847, "uuid": "349f24c9-2d99-48f4-a8ef-ed2e8eb8c528", "value": "T158A5BD5D84B06CD26014FEB4F685FFD7CCEB5385162707520FE4858A6322C83FAAB6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286847, "uuid": "591eb2d8-a4ab-46d7-887f-0f58c72712cf", "value": "24576:TrYxBapxwEzmnxO/CApTDXxGLP42oa2A8pCE:ZFXzT24cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286847, "uuid": "98b5f122-53fc-491c-afc5-a32f25c92731", "value": 2075600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286847, "uuid": "994d396d-7eac-4129-87a5-f71a8ff77525", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286847, "uuid": "d37a5e4f-992c-460f-b11a-748e92ca9028", "value": "02001499815635.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f740087c-d524-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765301519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301519, "uuid": "3dfc7583-f229-4dd3-bed9-21c2a648c781", "comment": "Malware payload (Mirai)", "value": "daa64dc14891f3a1e426e20abdd78f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301519, "uuid": "13b095cf-fd87-43dc-9e7d-4836cb554e23", "comment": "Malware payload (Mirai)", "value": "8583ff2ec07e367e534a6260afc4b7ff95086a8ba78a638ccc99d010a145fc41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301519, "uuid": "0a2223e0-51a0-4830-a2c2-e3998afb527c", "comment": "Malware payload (Mirai)", "value": "2886ccfc6bb4392d5deb95720ffbc555a2390157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301519, "uuid": "edd0c729-f798-4407-95f5-2aaf756f9bfb", "comment": "Malware payload (Mirai)", "value": "f42355db3d3bc4b275eb1f6ce001fd458ee151d49d914ea31723ea533c1903fc3d506a5547cb870a6a53cb7c9c005936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301519, "uuid": "89b173e6-331d-4809-bd39-fc9f9a1c285e", "value": "T1BC430946B8818F25C5D412BEF92E118E33276778E3DFB212DD105F25778A92B0E7B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301519, "uuid": "c064f7e3-6678-454c-8330-9b3b52890ea0", "value": "1536:AtnFN+AQlQEh4wXdjXbIMLxxGb9zMric5uw4SOQT:1tl4UXLz5uw4S9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301519, "uuid": "f6800856-252e-4f64-9a06-8de9d3f90ef2", "value": 60508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301519, "uuid": "404fde9b-0ab6-416a-9a96-588f63c39e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301519, "uuid": "d23b15f2-902a-4138-9818-9af69b8c1254", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa85407-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248114, "uuid": "ed805377-de76-495b-bbce-a462e01f633b", "comment": "Malware payload (Mirai)", "value": "f1362cbc6857bc5b655a1b0631820b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248114, "uuid": "92415a49-7611-4f89-9acc-7d08d1be8dd5", "comment": "Malware payload (Mirai)", "value": "87512d3762057f799ed76d9310d94c8ae3798623259cff636a68001958b7ed47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248114, "uuid": "5c54a93e-7735-418e-ae87-993863866123", "comment": "Malware payload (Mirai)", "value": "3ae270dfc29047f28865dc7dc07c8c0866d1c6e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248114, "uuid": "797946a1-5bb5-49c6-84b2-03c2c6793e18", "comment": "Malware payload (Mirai)", "value": "0cdf6d55168db3bedb28c129f29f3d8b40df1eedefcf9d41fb8ec74c970856c0c97de84518ff578776883bd5255cb32b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248114, "uuid": "fc9c1ebe-b025-4071-991f-ad43ee10195c", "value": "T1E504D61676C38CEDC053C7B55A8D946B71B0F12F822E503367B1EAA03F1DEA1A9A7351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248114, "uuid": "327ab8b0-997e-4eb1-b1bb-24f78b7720fb", "value": "3072:6N2nBmZu1EJqCKLqoE45zM5NCUXAaBljZIMtyDpqPQmPOLVPU8oJDHX:DnJe45z+3lGM8DpklPOLVPU8oJDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248114, "uuid": "a415a4e0-7a71-4030-8c4e-291103261986", "value": 175488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248114, "uuid": "ee54f41b-3c9d-4c47-8679-58c72b93b0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248114, "uuid": "bcead4a7-4da3-437e-bbe7-f392e835ac79", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff076fe2-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300673, "uuid": "37529cd0-9e7e-4cb2-ba25-4f9d1a730ddb", "comment": "Malware payload (Mirai)", "value": "668d5a3c79099bb8cdac3ca2e85bd84c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300673, "uuid": "0c9f6980-ff40-4b9d-aa1f-41ee58f37c86", "comment": "Malware payload (Mirai)", "value": "87fe7aed871eed9653e4aa576c89953b992414f066dbaf8876c5fdbca845565e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300673, "uuid": "010fcdb2-bd2d-432c-9ad4-d62187f6514f", "comment": "Malware payload (Mirai)", "value": "564edd65eb35edf857a89829beb59021565ea808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300673, "uuid": "87a78c98-e533-4ef6-9f3f-6f83ad292da9", "comment": "Malware payload (Mirai)", "value": "48c4d1f1c6d7abf51681a33ef49942194d2b9c36a22310ae16596d9baf35a0ec8216b8386f517a8cfcb963d1f4428089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300673, "uuid": "e3ad9236-2fae-4032-8545-d9cf245934cc", "value": "T1CB53D81A1E258FADF76C873547B78E3197C8339636E1C645E16CDA001FA034E649FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300673, "uuid": "8b02418b-ed99-4fc6-becb-958996362d01", "value": "1536:ewzzAbVaOROUDVVberd0SPrgPrWdPrrEy3dRc2ynTF:zA5aOR3DVVbereM3wTnTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300673, "uuid": "6cea6d4e-ac65-4378-bcf9-1e9e5c57d9c3", "value": 63964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300673, "uuid": "391739b1-f510-42e1-8561-d984b939f06b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300673, "uuid": "31688ef6-8cfe-41d5-82d9-a430fbad8c46", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746eb200-d522-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765300440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300440, "uuid": "c9d7a92c-5b5f-4b00-a660-47d93ce07c0b", "comment": "Malware payload", "value": "86ef1039916a240ad6546fbd91a51878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300440, "uuid": "6f2be51f-c81e-4a79-8e39-c5d9f7290908", "comment": "Malware payload", "value": "88f0a094f42ee58e0b086ea1583a3af2a7dde8323190388a004b678e94de78dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300440, "uuid": "2e5a1bf3-56fc-40f3-9cfd-f64dcab376c9", "comment": "Malware payload", "value": "608044af526ef1847b44ace7e5e097f70b2ecf3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300440, "uuid": "f5773bce-4cc1-4938-81a6-a054bcf6b455", "comment": "Malware payload", "value": "e830b10a364b0a5238f0bf425e4ccb4cfa049808819880db33cce3f2d74459e50608285629c10f94b7bcb830f5f87911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300440, "uuid": "91f01b55-0d48-425d-bb23-5bd078b5f7f4", "value": "T1FC533BC6A802CD7CFD5BAA7BC91A4B00F528736596420F27966DFC936D720D48C3DDA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300440, "uuid": "ece243c5-45d4-41b2-afe0-2bbd5cf833b8", "value": "1536:rodeI+N9G8EUrjGnYdpppppzZwGH+qH8ulxUdKS2jZnW+3yPA:rodenDEEGYdpppppzZws7xI2dnhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300440, "uuid": "6958de30-5e61-44e0-bd8e-a53a05d9d79a", "value": 65720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300440, "uuid": "95d4c40f-fc4c-411e-99e6-a5e943d5f97b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300440, "uuid": "e12e3a7b-a8e5-44ed-b110-5404f8db5ce0", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dfd62a-d54b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765318128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318128, "uuid": "651b8b52-3d08-4f2b-8242-256b5256e6d5", "comment": "Malware payload (Mirai)", "value": "c2560387c6bfe4205b46c0e32805a3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318128, "uuid": "454bf397-ead9-4a46-a85a-f1042b908542", "comment": "Malware payload (Mirai)", "value": "88f57bfe861baa09b93a1adb626ed6569d6f012e96eb86cf0105963690126aff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318128, "uuid": "b62ee8b8-4462-407a-be8e-2e71553a607f", "comment": "Malware payload (Mirai)", "value": "39d2a4f90886d1a9b611b921dba3652edd266fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765318128, "uuid": "a3310721-1442-4877-ad14-8908f24802bc", "comment": "Malware payload (Mirai)", "value": "9b475cf9e995ef541ac232e7d04d6b8b7a219ad2b51c36a4c9a889e3832a668eea22265fb3407477cea44cd09ecaa693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318128, "uuid": "8d6f1e55-d56c-4212-826f-1689ea16de94", "value": "T14B8312156A7862038AF02872FF98ECAF136EF5A1D2D33BD81B18817A6709107397754F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318128, "uuid": "83986bd6-539c-4058-92b9-141786743ee9", "value": "1536:MTQ2FY3N/ZzLknQpZ6DHyoazIF4KiKq8xxAKCwvrp/k+SW4eExfolvfz5:UBwtAS4byoazIHiKPxe/wTZkl7HfIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765318128, "uuid": "fa240646-c54a-4b24-b53f-2d1d08e2e202", "value": 82068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765318128, "uuid": "c5033ba7-4198-4c19-8678-79dfc0403cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765318128, "uuid": "f95b71a3-f9e7-4856-aff6-2ca7a57a1f3b", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707fd678-d548-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765316755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316755, "uuid": "41767074-1084-4681-87f3-854c0abe6a4a", "comment": "Malware payload (GoProxy)", "value": "8ea969e6cd9f7b0e11a9f6716cd8c352", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316755, "uuid": "6b1527ce-9077-4b5f-b4af-115a6ec3a2f6", "comment": "Malware payload (GoProxy)", "value": "8c69bf1510821ddc6a072700e6d0c9e58cf7da4593c801501198cbcdfe8ec5fa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316755, "uuid": "ec85bb6f-0b86-471e-80d6-8bcf690cf5b5", "comment": "Malware payload (GoProxy)", "value": "a268df702056f681349f5fccbf5d91a1fae82422", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316755, "uuid": "b4316d2f-e478-48ec-b4d0-c441e8f8668d", "comment": "Malware payload (GoProxy)", "value": "b802d55d7aea20487effe9d1e2b29d103b6aef2b2cbd37b23e04e1cce7f45eb9ea2c27d2f035eeb5a40aa9e64336e954", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316755, "uuid": "427acac6-3769-476f-97a8-085fb9b3c256", "value": "T198664B03EC6545E9C0BAE23086679262BB717C885F3123D72B90F7292F76BD0AE75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316755, "uuid": "64980150-5e47-4e1e-8713-07b0762f1dee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316755, "uuid": "40aa1603-ea8d-4337-b509-ea73bd3fb650", "value": "49152:I/voli0b5tJ8puY5+lYprht1eQXshBjwAVZfAlQRT60YVhv6Uza0Iw3qU5j13beT:I/QR23YJwEYl49YmrlIb1ET9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765316755, "uuid": "8a8c1ed2-22b0-4338-a5ea-591046242d5c", "value": 6698560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765316755, "uuid": "744b746d-f677-49d0-a42d-2473dbf19b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316755, "uuid": "d8889f50-d0c0-4b1d-b3b5-c1b3bf310624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed7d0e1-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287922, "uuid": "ec9c1640-4863-40c1-895e-94901a9bf46f", "comment": "Malware payload (Mirai)", "value": "da73eca5d8fb46880b452ce968ef9dbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287922, "uuid": "99f28667-20f3-4e68-b099-be6feea9741c", "comment": "Malware payload (Mirai)", "value": "8c7a457dbb3a01c8cc293ca2e1d297c61ff205699015b1bc6ea9e8644466ffc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287922, "uuid": "b74a1590-15d0-4122-a32d-6646e27299de", "comment": "Malware payload (Mirai)", "value": "37df8c216f87974967932890128ddd12578ea62e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287922, "uuid": "6b26ffc6-7881-4a35-ab2c-f1b5a51eddca", "comment": "Malware payload (Mirai)", "value": "bd547fa3be883fa9b08c5e40bd9ebac0a4054058c0601a6f58081067fa3eec8f30ae4e0a592780b427594e7b3f406dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287922, "uuid": "35313912-b64a-4b88-a8cb-305051db312f", "value": "T11F93C64A2E118FACFBD9823487F75A319258379537E2C584D2ACED011E7074E741FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287922, "uuid": "9fb55b2e-55b6-474a-a4e7-166248b8a06f", "value": "1536:kL/Iw3CoLlOQyG95A1qqk9w82AuOjhgRqRukpOz3xT57aC1Iy8U/lD:kbnSoLEME1E2AuchgR+pOz3Bz/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287922, "uuid": "6a3cb9d5-4717-4fa0-89a6-3f35a3edd5f1", "value": 96468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287922, "uuid": "87c0869f-f399-4b51-a2e0-89c642d15e31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287922, "uuid": "ddd01841-ff95-434d-9811-114470a02630", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4befabb9-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287917, "uuid": "f56fc453-dfdc-4df4-8014-4387a4a7fcc2", "comment": "Malware payload (Mirai)", "value": "261faf453f5805112d271478d7d08e02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287917, "uuid": "e7201c6f-6964-43f7-beab-b3855e342638", "comment": "Malware payload (Mirai)", "value": "8dad3875e114d40607d365aecd5d04e14d4751c22392bec6941271daa8a256dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287917, "uuid": "7df80d3a-4f3f-438a-827a-c1f0b8963927", "comment": "Malware payload (Mirai)", "value": "863cc027ec92759453c7eaa1ae71429e03952663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287917, "uuid": "66dd9ff9-ff4c-4e03-84a1-02cfec9c5ae5", "comment": "Malware payload (Mirai)", "value": "ce6cf5d7ef6ee914e66c79710c600410415a495047e42ad8e4159fdd353cffe0644b3c51f36f1929cdb11bb21d1ec5b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287917, "uuid": "54bccc23-b6fd-41c0-8edd-a51fda49af78", "value": "T12E331985BCD24A5AC9C413FBBA2F428E331163E9D1DF7353CC044B1576CAA0E4DA7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287917, "uuid": "13aa90dc-538b-4a4c-b29e-983599378b4f", "value": "1536:3xrKrxriOW3rw+70tfWAsHMg6X00czKwwObV4qs+BNrch+c:3W+rH4VWAWl6nczKAVVs+BRcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287917, "uuid": "eb35918a-d115-4660-b316-a87c967f11e6", "value": 50764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287917, "uuid": "c396e19b-a2f1-46f4-8107-d1d64cc3105c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287917, "uuid": "29124fe8-226f-4c4d-8357-27130b624170", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bfb0c6-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286168, "uuid": "724c5733-803b-499e-9fbb-b4c4ed74a853", "comment": "Malware payload", "value": "e4617cb5fc7612bae62041a8e2e15a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286168, "uuid": "ac9f0659-6c38-4069-a69a-9ec2cd42e885", "comment": "Malware payload", "value": "8e068cdb252ff4fb64ed1bc6e6f50f1872cfd8136f7651b347495ccde51d562b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286168, "uuid": "1eb86e8e-81d3-4f04-8037-503fe72cb02e", "comment": "Malware payload", "value": "1c67d9211d834c30479169681656da5c20ad88c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286168, "uuid": "7d1300af-abb9-45a1-b3ce-1a842c8afa46", "comment": "Malware payload", "value": "5589ba41cf1cfcc130499c010543a9e7ddce9a889334d6a9f949c314d2c1e40c88d97ef2ff3de15bd1ff81643e71e82b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286168, "uuid": "3ae190fb-b11a-4c1f-905f-f14ab37bd48b", "value": "T163559D19669A80F5D06BD13988A6C55BE7B13C0D177097DB23D92B5E2F332E08E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286168, "uuid": "ddb7e92a-d58a-4868-b508-126be46778b8", "value": "fad99856e3073e539ca47f6839494872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286168, "uuid": "70e65f05-e130-4ad4-b5f2-71a490d025c1", "value": "24576:IhePLN5U3LD6p7ZZQnGJofKF6Zy2DvaBCaGHEh3ySize:IAPzcWfQnGJof7ZJvYCaYe5iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286168, "uuid": "a4dda4b4-6e4f-4f7d-bb1e-b7c8cfe0eed7", "value": 1367552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286168, "uuid": "4b84240b-fdb6-4f2c-8bfb-3659a057f675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286168, "uuid": "bc8efd8f-163c-4da9-9dd9-aa549129541a", "value": "08b96e496291ed15b6a96d013dc2c1e5c76e2eb3211e01afca0ca22c333a8fac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f2ee8f-d52a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765303795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303795, "uuid": "8af89354-4ac4-4f08-8bef-06da376b84d0", "comment": "Malware payload", "value": "e67fa84078d0dc32a567b45b61608e5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303795, "uuid": "ebdd5031-dd4b-43dc-aad2-2c6a26d70b4a", "comment": "Malware payload", "value": "8f747d957aa51c5f94c2a262f138151ca24bf226ebb38dddfce72f97203fae54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303795, "uuid": "87972a9e-77e9-4b77-8dab-80d314333fc4", "comment": "Malware payload", "value": "dd491f0bd2fdc04a6e7ea5efad822080505a6663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303795, "uuid": "836f5b17-3127-4f0c-bf42-2514a51b417f", "comment": "Malware payload", "value": "a8b3fa83bd69765db070e0680f292522b43e10ad4711a7f15f0fea58b7ba0ba1b4b3d052f83969e773966e1600ab8c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303795, "uuid": "08e5f543-a5cd-4ef7-b980-4a7f62bc4a5e", "value": "T17264128AA626FD65E10B5BF117BB8E94B9FD664F82E0C0A592CF534311DC343B5C0B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303795, "uuid": "98812498-126f-48e1-b279-d1cda54e033e", "value": "3072:Nc4i0agsmw3Py5CP5HM8EVLUuYtgB5H6o:Nc/0aNPy54EVAhOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765303795, "uuid": "10360f6f-5db8-428e-ab8e-4285ec8d740d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765303795, "uuid": "898319f1-a47a-47f1-8242-545e5f7884f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303795, "uuid": "1d38a564-de9b-40dd-a594-a09a9f6cd6fd", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd43353-d49a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765241989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241989, "uuid": "d219f2db-b13a-4f0b-9f82-f7831c2e48a8", "comment": "Malware payload (Mirai)", "value": "730c7d55d9eb134d55217b45c44e7860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241989, "uuid": "cc1a9685-82ab-4dde-81c0-76c2c1574621", "comment": "Malware payload (Mirai)", "value": "916ff20b14c6e0a8142850a4a429b3b9e919b4c1ef513d2ec643ea1b9da83b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241989, "uuid": "d95037bb-078b-4087-a24a-07bf4094afd6", "comment": "Malware payload (Mirai)", "value": "c4d3e26172b3b80632d3c1d056882bfe937e6145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241989, "uuid": "9c6e82a8-92f9-43c0-979f-0af7c095ccef", "comment": "Malware payload (Mirai)", "value": "92f890e6a1ccd79984bf6dfb1b453a19a8517ad83f711ffaa900731b58736cc99b47d280a64dbb9e6368bbc11133a2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241989, "uuid": "063a1413-5444-44ee-9adb-6b8a49a746d0", "value": "T1D6A3821ABF604EF3ECAFDC77499A2B45248D141A21897B78BD70D814F64E24F19E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241989, "uuid": "e719a124-3cdf-46f1-969f-0c4bcb74cf3c", "value": "1536:mb7/BCaYLJcXPJyf7j+FaBRiA1HzxZ9t7X1yu:kLAaYeXAnPzxDyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765241989, "uuid": "0d636817-e767-4995-a4c7-e2415884e372", "value": 100468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765241989, "uuid": "4f25eb76-68e1-44e1-b72a-cad0e831f3ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241989, "uuid": "97df45ea-b53e-4a05-afa7-b16154894a06", "value": "Fantazy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d423e099-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765285998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285998, "uuid": "7637f88d-65a5-4216-972d-987e6425506d", "comment": "Malware payload (Formbook)", "value": "c0096934ec01b14d1889f046de58b8e3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285998, "uuid": "b64d3585-977c-47f1-95e4-6ef2af497ffe", "comment": "Malware payload (Formbook)", "value": "91701760fda8379744e8f2ceac55f62c6201735904dda25c6cdfda54ab6d6f81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285998, "uuid": "9a6d6f1c-bcc2-4dde-89a2-cc1e742ce025", "comment": "Malware payload (Formbook)", "value": "e8425faee595b0a6a00964b48cec0f188d70d9fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285998, "uuid": "1e4eadce-cc27-4e52-8607-b7383f152fbf", "comment": "Malware payload (Formbook)", "value": "dfd2d73ea980b0f613b95a761f0b6a8c07ba04ae738c335cf8db29ff9a6d9b0c3318a6238be442f5d89ee72c6dc89949", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285998, "uuid": "580f20ab-276a-44ec-b599-d63f9508390b", "value": "T18BD44A20DD2416B94F071BA9FD541E61CAFC960A552A90F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285998, "uuid": "c60cf0ae-e9d9-4958-a588-48664a3deb57", "value": "12288:sKaKBKlJ1LKlJIKlJg+I+KlJg+lKlJg+I3KlJg+ItKVKlJg+ItKlJMKlJg+ItKla:sKaKBKlrLKlmKlxI+KlxlKlxI3KlxItE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285998, "uuid": "5e689569-51fb-4a9e-be91-020d7ff76def", "value": 598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285998, "uuid": "77ce3380-51a3-4898-8f6d-8e9a1cc29041", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285998, "uuid": "8d95f678-e734-48da-9065-360b980f0b3d", "value": "RFQ BN1068-MSRF-2833.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aebf96b-d515-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765294760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294760, "uuid": "22c466ac-cb31-4c8e-a1e6-20e052070a93", "comment": "Malware payload (Mirai)", "value": "4db12fd605dbbf42ad155029b81e7f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294760, "uuid": "e15c5aae-b28b-409b-a1bc-2832b7238a24", "comment": "Malware payload (Mirai)", "value": "91e2d801fef77a99bf929d10f41f531d90927d6a6b9badd896afe797c094578c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294760, "uuid": "b9cbbc86-fde2-4d70-a91a-66a393ec9416", "comment": "Malware payload (Mirai)", "value": "6fda40ba8000171a5f8ddad485dad781a8a0c664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294760, "uuid": "a7e97eec-a0d7-4545-80b8-46c60c0d6aea", "comment": "Malware payload (Mirai)", "value": "6179d32877ddad5a9a3f1b4bf92000294034e600192f16c93edaacdb013e50239dcd889843c5c316dd12daa6e8a4dcbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294760, "uuid": "afc6aecf-42c2-4359-b668-d7465090d64d", "value": "T1B073F846B981CA61C5D952BAFA2E51CD331317B8D3DF7213DD106F247B8A86B0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294760, "uuid": "c77ccf4a-9cf8-498c-a3e9-cdb2f14e0b36", "value": "1536:ftnekrs2ARan1VWEAgqM4PLqYcB0TYG9r/5Q3qMWijjIObzaRT3bsR2:5g2D1VWEAJAYE0kGojIObzaRT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294760, "uuid": "d0c9bed4-0fa7-47e3-be5e-62c256365cc0", "value": 76512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294760, "uuid": "1f9c32ba-77c2-42b4-9763-c5e1454a3eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294760, "uuid": "3a376e47-7fd5-4161-84df-a840303ce67e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a06279-d4d3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765266732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266732, "uuid": "b8a66bc3-bf59-483c-8635-f73acb62f88d", "comment": "Malware payload", "value": "a8ecce20e1279a8c4168cf94fa9a8529", "object_relation": "md5", "Tag": [ { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266732, "uuid": "fb9a9867-b656-45a1-a3a7-b1ba961f6553", "comment": "Malware payload", "value": "92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455", "object_relation": "sha256", "Tag": [ { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266732, "uuid": "56d5f508-85d1-4070-a36c-1e9e7c718ab7", "comment": "Malware payload", "value": "4b2327151fab85900f53dda504002d5e6c6019e4", "object_relation": "sha1", "Tag": [ { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266732, "uuid": "abcaec20-720a-4ce5-80a2-5f04a217b66d", "comment": "Malware payload", "value": "9a1d35dc1dba817c9c5e4754bdcbd482867d5b02b3ea37238168721fc1e7326d1ed4213b507389c0da5f64db70c40579", "object_relation": "sha3-384", "Tag": [ { "name": "Matanbuchus_v3", "colour": "#DD7914", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266732, "uuid": "5e3be3ab-ea11-4ac8-a980-ec27f77e92c9", "value": "T152560221BA8FC537D61D0276E52DFE8E543DBE63472181E3B7E8784958708C257BAE02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266732, "uuid": "630ac911-8128-4633-a9c8-42617f31c649", "value": "98304:jjV2IMWIqr8kfma9fQ5S26Zb9urOO/oePq2vZGIabVNGDD+K8kTMOqg1I/OmeZ98:fV2cqkfb945S/bSO8oePFvZGIaDGDaF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266732, "uuid": "e80beb97-f9e2-4d12-b85f-efa02051b268", "value": 5993472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266732, "uuid": "c88bb5e1-00fe-421d-8eae-924f965e15c8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266732, "uuid": "df6951e1-0906-4cde-8505-8b8ef5fa41d7", "value": "92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bc2dd5-d533-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1765307709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307709, "uuid": "7cf880c4-c247-4180-84fe-82a2b9ec881b", "comment": "Malware payload (Meterpreter)", "value": "bc1b112233500f4032b309c64addee7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307709, "uuid": "755c77bf-3410-4c12-aff4-12782d62983b", "comment": "Malware payload (Meterpreter)", "value": "934671323bc0719346edb90b9de8dc95eca30a38ed3789629589f1010b112aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307709, "uuid": "27394d59-84ba-451d-85f7-39c4239d9960", "comment": "Malware payload (Meterpreter)", "value": "99b9cbec043120be6b5009f600b563f89aa477d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765307709, "uuid": "c0cd2688-a13f-435a-a426-002f8b357658", "comment": "Malware payload (Meterpreter)", "value": "05a78b6e9bbc867406eb9ebe558b5720d62721675c23a9717ded8b9e87e6ee0a86a844199edd6071ceb9d4cb702ccabb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307709, "uuid": "adbd948e-6214-439f-ad22-7ce4056e12c9", "value": "T11473BF43EDC42862C1A5227D267526B5A975E5F63306C1DE3A8CCDE5EBC1CB052363CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307709, "uuid": "14e1a5cb-c78c-4d4b-b29c-0f489496d25d", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307709, "uuid": "f7aad72e-86cc-46db-993c-aa7dc26f9abd", "value": "1536:IXAE+cB0v4ps5IyPzYQN9y6Mb+KR0Nc8QsJq39:SSUSEoPX26e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765307709, "uuid": "a5a0ba92-fcb1-4bfa-b6f0-1f15096ca7e5", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765307709, "uuid": "0926a480-47cb-4194-a74e-2fc97e3cb120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765307709, "uuid": "e5f93a1f-270f-4dca-b8a1-d4de8b46f924", "value": "meterpreterngrok2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f65a97-d527-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302730, "uuid": "14b52673-069e-484d-b908-c921ae7b0f95", "comment": "Malware payload (Mirai)", "value": "89cd111bfb8f6fde9102021af2dda8bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302730, "uuid": "400b39eb-8441-4f3b-ba70-082c49f47ec8", "comment": "Malware payload (Mirai)", "value": "93dbbdb9ecd894f4b1a3f0bc9ef773e65ec629e8ef23e481c597c067734a3a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302730, "uuid": "03611ac5-5d33-40d7-a0c0-0ce1ec8f9f72", "comment": "Malware payload (Mirai)", "value": "608535e2c3ecc8f402bc8541a812e08231e73c3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302730, "uuid": "677ef3f6-d297-4de4-b591-5ea0f5e3860a", "comment": "Malware payload (Mirai)", "value": "63199c2456db0a86a23a81ee6c1e73314f9cb8e250a02591ab550b984ba1b47c71fc2282560909cb9965baf0852e28a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302730, "uuid": "54ce309d-ec39-41f4-8fd3-ea87fdc64921", "value": "T1BD331880B8919A23C5E4227EFA6F419C372663B8E2EF7217DD125F11778982F0D77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302730, "uuid": "04b2b8c9-8651-456c-ada2-4764c1b4bb14", "value": "768:pVdz+7QXKCN3OL7D5x3kWL0/i9ci0PkZ3tWgCdyUh3KM3FNFbz/8oyT:Zz6QhUx35/ilPkyHj+NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302730, "uuid": "49e6d593-8ba7-474e-aba0-20c787c20577", "value": 50680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302730, "uuid": "351f5c6b-10eb-4fe9-8d38-88a2f71865e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302730, "uuid": "aa3a69b6-87d0-41b0-8853-3614c0bd1e05", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b185c1ab-d4f9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765282933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282933, "uuid": "ed6c66aa-07b6-4248-95f9-b6e4c80b56ab", "comment": "Malware payload (AgentTesla)", "value": "e5a39ed51d168832f32d48220b6f6dbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282933, "uuid": "c214e78b-4968-43db-9102-9bbacddfadae", "comment": "Malware payload (AgentTesla)", "value": "94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282933, "uuid": "e5ab3ab1-f029-4e2d-a042-71c7b06fbbfe", "comment": "Malware payload (AgentTesla)", "value": "0227af4ce1fa50bb3105c2d2a2aff23f70f22f47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765282933, "uuid": "9689eae3-51f3-4ef3-9308-aed815d0038a", "comment": "Malware payload (AgentTesla)", "value": "278072e45f81fb301cdbcf1a154699b6994f0201ad15cf1733321698f83d65b8722b1728190c0421fce013a011feb153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282933, "uuid": "c3bf9b35-20e5-438a-a41c-a8855237da59", "value": "T13AE423351ACD5A10474CDFBD23C86CE28949F28F253E14B6B76EBF2F4614B08168796B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282933, "uuid": "f9841066-4151-485a-8c1f-dbb919ffac2e", "value": "12288:SJ6iEgo82u/b/O4YgdjtdVpweJOKvxVoeXF+MFarojHNyDEq4yvA:SJDERGYstL66OKvNXYMNyDEqfvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765282933, "uuid": "19a069d0-7209-4c28-a057-48e410ef3b17", "value": 715088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765282933, "uuid": "53e914b8-93e9-42ae-bd75-64c1b9a90118", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765282933, "uuid": "664216ec-02df-4fa2-8819-b6b2ddaaeaeb", "value": "25 Ruixing New Order.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f42be2-d4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1765270730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765270730, "uuid": "b2caeeaa-e826-49f4-bd22-7477419e08ac", "comment": "Malware payload (STRRAT)", "value": "ac6ec24dd9424e6dd2ec8337eb33bb4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765270730, "uuid": "4aea7c7a-3ebc-4a0d-afe4-4a170aa68322", "comment": "Malware payload (STRRAT)", "value": "95701b2178c9f1544146bab431311db2acc30b59e3c387e830a93a995a7764f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765270730, "uuid": "29a9f68b-0a46-4dda-9b0c-8b5afa69db9a", "comment": "Malware payload (STRRAT)", "value": "f73d3428bd7c09ea1867c99c5fc1805f7b43de5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765270730, "uuid": "928a0804-da31-4704-a77a-030c41d88233", "comment": "Malware payload (STRRAT)", "value": "74706711b3b0d8e927869549113c33a2052e0af12fcc3e885837ff0cb20f66ee6b50319f2630a06b9735478b03d48b2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765270730, "uuid": "64833e04-be31-4423-8422-016934a1e39e", "value": "T1100423031E95AD7E9C4C5D139813F3CD88365EE4928CBF9D79102E4681E1A7B9D2BC1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765270730, "uuid": "78e729e4-08c9-45b7-a7cb-3925236c56a2", "value": "3072:OfEYSR2+pe3Ulgl80UQMzJKM6Loxm+l2bVXxa+EWT3KurV66wHYcDpzpfRFzl6G6:5yG/0U/Fkoxm95E+EcdlwfH7xTii1Oxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765270730, "uuid": "7b406287-f70c-439c-a947-0d396c5606b3", "value": 189836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765270730, "uuid": "562f726d-6bf7-4a1a-8af8-43897d6e7fed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765270730, "uuid": "ee5adbba-f93f-4f65-a1d6-15f07223131c", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058e544f-d520-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299395, "uuid": "7d8a22d0-49ba-4fcc-a2db-1a999ea55ec1", "comment": "Malware payload (Mirai)", "value": "daf146aaa464dd95dcd4a194b8721e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299395, "uuid": "96420952-5bb0-48b1-8387-545b96d6cda2", "comment": "Malware payload (Mirai)", "value": "957d34c75d6dbf72c05f20ffdb9589c58c66dce41b521fb2e714a190c1b9592a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299395, "uuid": "58aca0d1-dfda-463d-ad06-d375c4331730", "comment": "Malware payload (Mirai)", "value": "b42ad5c229d92969b4b6c19ebb8b38bcc38c3078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299395, "uuid": "ce175f51-1de9-4207-a24a-9338167d6ce4", "comment": "Malware payload (Mirai)", "value": "b23614a3cd7adc50db5ec6efff7645cf1f4ed6b5a23703474b9f5ee968ddd49afc81504ff2bedc85b782b23f7f6ae1d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299395, "uuid": "1dca534c-fd7d-4a8b-a42d-0d6b8cc9dfab", "value": "T18563A316BF650FB7ECABCD3745B91704288CA50B21E87B753934D918B68B25B09F38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299395, "uuid": "24ed329f-8ab3-4c0b-bfb8-a582f2bd59c0", "value": "1536:rfAPLF1hSOgUHxCU3PDBvQAoHqkcRFsXH/T:r0JSOgohbhc/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299395, "uuid": "ab0f912f-5872-44f0-aac3-7bf3c1628a73", "value": 67676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299395, "uuid": "c18000ac-888e-4bc4-9ab4-a472ee7e1293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299395, "uuid": "330e4d6f-deda-45d9-b0a6-68aa02f19ed0", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8ba0b6-d521-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300081, "uuid": "07814a4d-986d-467a-9e7d-55662b9a8c94", "comment": "Malware payload (Mirai)", "value": "eaa8903290db4d77e518d948cb6f1fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300081, "uuid": "8e995a30-4f55-41b8-87fe-4db9c9ddaa23", "comment": "Malware payload (Mirai)", "value": "964cbc8388c9b95046f986b8618878198adff6932f1e8918f797c105bcca49df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300081, "uuid": "c9629642-ffb6-4178-8623-c634bc95da3f", "comment": "Malware payload (Mirai)", "value": "d3f60f668c279e4b80e2f9796e6d49910599b263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300081, "uuid": "50b5a304-b911-41b9-a97f-bb7ec823d252", "comment": "Malware payload (Mirai)", "value": "ef5f560881ae7203940b95adfb1bad517469be7172f272d9a9110c47148a7ec92c61c184136f6a050b939273dcf6903f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300081, "uuid": "15c6646a-fb43-4807-ad4a-ecc31a790dea", "value": "T132457D367711EF69D368C57009F38BA486F2219217E24185B278D32C7EA261D5C8FEF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300081, "uuid": "7f73eb0d-65fc-4c0b-94f9-454076ebdc45", "value": "24576:kiEN4rQQiUYUev9epzJrLLdfXvfiMZsPVC0T9Hrmk:+4r909e7rLhfXNZsPk0T8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300081, "uuid": "6e0e3439-8e1e-4205-9e24-9b4abf65595e", "value": 1190224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300081, "uuid": "ee9444cd-3062-4012-bf85-9ed9786037d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300081, "uuid": "e1c4a2c4-7789-43f5-9cf7-d756f494b6af", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572d954b-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298244, "uuid": "1d60ee04-39c2-415d-adec-36bced0ff5ea", "comment": "Malware payload (Mirai)", "value": "072b52cba3d265ddd98276cd6b6d09f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298244, "uuid": "342b3816-af36-4b56-b4f0-d7577b3e3a7b", "comment": "Malware payload (Mirai)", "value": "96cb6ce6471032727babad280da75815939b16645bb48a92097ea2682efd2317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298244, "uuid": "2698c837-172d-4b7e-b35c-2cb1c87f29c2", "comment": "Malware payload (Mirai)", "value": "2345c447bb678fab182153897863b119f34218be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298244, "uuid": "9518a55f-e133-46c2-ab04-b78668290bc9", "comment": "Malware payload (Mirai)", "value": "96e4d6ecb0b76fe83eb8c0dad6637208473f0010b6ed9b2f45c445cad15deda5b44901dd6be97dd6d27b168cb6b3f569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298244, "uuid": "1d6b5ef8-8a97-40df-8798-b82430c00e75", "value": "T100630985B8918A17C6D462BAFA5E41DC332613F8D2DF3207DD11AF157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298244, "uuid": "c2d5a929-4980-4f9a-9d22-1d08f87aa53f", "value": "1536:Pb07Bw2nGm6MKWiNPbAwAWNfJ6Tgj/CR/VcT3bsR:Pb07aWwPHf3eRtcT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298244, "uuid": "89f4cdbf-676f-4b3c-9e83-4fb30e085221", "value": 66752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298244, "uuid": "4eabb00a-87f2-436a-b2a8-5579a06dd61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298244, "uuid": "842350e4-7baa-4d34-8ea6-9ebe048e7f35", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc40c04-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286393, "uuid": "07754370-859e-476a-84d6-b0bc1ef7c573", "comment": "Malware payload", "value": "5b10f08f2cf2b48b095117d279f7366c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286393, "uuid": "ac619430-c4db-48c9-a099-ffbf44d3b5c2", "comment": "Malware payload", "value": "978337c1d9884abaf3dffaf9b4f701c8319ac3503954bbb0051741fc1743f403", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286393, "uuid": "4889fe80-fa0a-49b9-9c6b-0ea4e894fa5f", "comment": "Malware payload", "value": "86c2cc20451dd7c7269eaa7cd30d805c4a8d0027", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286393, "uuid": "1c1482c3-cb70-46a8-8fcf-f9e3273f4021", "comment": "Malware payload", "value": "26dc1c3b22da70e10c2aa5297fb45b0143a186a34f2dd6ee499a3e8362c0756e0c7789f4cc031dfd02c3707604346dec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286393, "uuid": "735e433a-05c4-4362-b8e9-30022143297f", "value": "T12934734063C4B89893831FBB7B1FB6E5F61B098D3448049BC216BCA4B57571BEBE1936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286393, "uuid": "75de4e0b-7563-4221-a226-d7c474c0b770", "value": "3072:6jZX8oHmqSiexAgF2uO1Aval3nlekVNmEqBN5t/Z79u:6Z8oGqxeSU2uO3EkVNmEQNj/Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286393, "uuid": "c58c97b6-e6d1-463f-ad6f-1a9d246091f2", "value": 234500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286393, "uuid": "74d5bbd7-1cc3-4f69-bfe6-299deae9f170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286393, "uuid": "2fe98b44-1287-44c0-9a61-d9a6c4fab201", "value": "BSAR000393483.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7ed118-d535-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765308772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308772, "uuid": "ca34e57e-20f0-4c37-8e27-a52474bd3dd7", "comment": "Malware payload", "value": "b2f0a9ecaa3967e7050cad33667a0cd8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308772, "uuid": "1359c868-b25f-4d01-8f28-9c3de10a963e", "comment": "Malware payload", "value": "98bbf0bbcd56c0562ac9a22eb0573b0f83aac0f9f5415db43bf33ef28581e5f4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308772, "uuid": "1d99a326-72a7-46d6-bc1b-e093923e6b1f", "comment": "Malware payload", "value": "51549369720e8f64afc4b07d3e0c42715517208a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308772, "uuid": "66e0e276-cee0-4a9c-8fb2-07707ade8cb4", "comment": "Malware payload", "value": "27a17fcad1c125818cb532adfb6fda020ebd0b427e098679ebfd33b58aea1861dd9fc095c73a1f22b26c687609d9c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308772, "uuid": "0b8f6581-d78b-4618-8b12-ecb198266d63", "value": "T1F3851263251D7C6BF07E5166854572A3CC08318ACB8FEEC9FE3A11966DE4A08C70679F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308772, "uuid": "7b7a272d-bcef-43b9-9836-edec42d66f94", "value": "192:NpEohjReembB3o9AwQ9Zp1ZkH40VypQ8d8kQ5S+NT9q546jwF:x6jwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308772, "uuid": "5bbe1b5e-3489-45c9-9203-dbf58bd71e6b", "value": 1849497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308772, "uuid": "b2a4f0ce-dd38-449e-82c4-21bb8bfcc137", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308772, "uuid": "96fa6749-b3bf-403c-800b-c1e9f3701bb5", "value": "QuickBooks-Payment-Confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c27f67-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248118, "uuid": "5ee3b423-ee15-45fa-84ef-81c80904c11c", "comment": "Malware payload (Mirai)", "value": "84202f1b512143845e75fbb2bdba72a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248118, "uuid": "b54cf37e-bbb3-4fe5-80ff-8b8de226ac0c", "comment": "Malware payload (Mirai)", "value": "997433271601e11425f3111cedeaf929a79b978d76fb6f5f399a0a03585aa40c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248118, "uuid": "a6ea1f3e-0991-4be1-bc25-f131eed3ad64", "comment": "Malware payload (Mirai)", "value": "d50ce32cfb2614316420cbd557cb4d3a0425d830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248118, "uuid": "062f90ed-4de3-418c-a02e-6bae9503b96c", "comment": "Malware payload (Mirai)", "value": "1009e567d50f6b4726ee85475ee51555035586e22fcd848fa7eff635b841888e29b9020bff690b8fed4fcb424febe165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248118, "uuid": "a497dbe1-bde6-4ea2-a6ab-f173d5bbbe5e", "value": "T15334FB05D9A05F5FCAE26BFAF74571CA327397986F833309D31C4AB023C16EA9916247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248118, "uuid": "1e752d8d-8966-468c-90b9-399e86eb2264", "value": "6144:PtonpyawrgNEbPj+ULg9KqqujEM/9/9mojKMl2k:PtgyawrgNEb7t9SV/jmojKMl2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248118, "uuid": "5db6aac9-a50c-4226-a60b-c1544712779c", "value": 249836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248118, "uuid": "0fdd7352-b77a-4f5b-b6de-f45b84e8e753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248118, "uuid": "053329bb-3b05-4c57-9046-315275a93448", "value": "Demon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bcef1b-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298329, "uuid": "7f25782d-a303-4157-ac5f-3ecfe2876865", "comment": "Malware payload (Mirai)", "value": "54da405cd49ded413dd36884aee18ede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298329, "uuid": "7c510c98-1693-46b8-83ce-4325e2c291e6", "comment": "Malware payload (Mirai)", "value": "9a2715c54d3741d6d4dbbc1bb4455cc31fac4fb3189632ac2eddc2bef2c7e47e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298329, "uuid": "1b587cee-f430-4625-904b-cd5014c58383", "comment": "Malware payload (Mirai)", "value": "30bd228a1b1440bf572ab76ac392e5bd6ff06fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298329, "uuid": "14b443b7-43d8-4294-9856-20d46b1947b7", "comment": "Malware payload (Mirai)", "value": "660479012facd67787b9a86bbe296be0f7a17be903ab9b108ea0377ce8bc671708787e33eb870f45125e1e906a0e5d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298329, "uuid": "6e815646-30bf-47e3-9e9b-a3177c99d090", "value": "T120B30855FC829A62C6C616BEFB0F829D332767E8D3EB7203DD245B2136C751A0A7B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298329, "uuid": "c5c3803e-a565-4e0b-b64a-5a465e5f236c", "value": "3072:luOnMdZ5RHmYmRDYidM/sWjZfO4FMFhbv+0849vFj+6/ZtoBcHAn5J:QOMdZnHmYyLdDW44Fkbv5d9xHZtkcH+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298329, "uuid": "00d3ba9b-5bf1-4491-8868-415d06464bfc", "value": 112032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298329, "uuid": "28dc934e-a609-4036-b2a4-a0ff7c22f764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298329, "uuid": "2eb522bc-a37c-4132-a7ac-a27f73b33367", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16341552-d4ff-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765285250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285250, "uuid": "f507cfd4-9f1e-42cc-a13a-12941ef1df75", "comment": "Malware payload (AgentTesla)", "value": "0bca326d9309c0aecda58af07be724dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285250, "uuid": "8e44081d-b6d2-482e-a55b-b960624570f1", "comment": "Malware payload (AgentTesla)", "value": "9aae2df453d839d3dace1a60816baf5d83ea1cdbc26544431bc785f7ad9b7921", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285250, "uuid": "84be05f1-bd1d-4fb1-8b1c-8b592e18f356", "comment": "Malware payload (AgentTesla)", "value": "d1fbe359ee785ea4fbd2ec7d16ce5b560056a30a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285250, "uuid": "cf482f64-6789-4847-b370-c4a483ccff95", "comment": "Malware payload (AgentTesla)", "value": "f9ae935f18d9737efef776972308d607aa0ca4996470c493fc9c8a2545def26aa383c58136b3a779112b98b9b6f67f41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285250, "uuid": "7ffcb853-20b1-44e3-a87f-bbd836efee4f", "value": "T153A5339DC1F0DBF2EA6D0CD13B5A803B49389DD716167CFD4D24BA0A544928BB9BACC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285250, "uuid": "09b3e758-4288-4bf0-ba96-fe44f2c5bc21", "value": "49152:gY60X+eso3qq+SmR+9S31h7o19fcemTc94owzfREkSuaE86L6r+:gYT+esgqq6+c1No19EJTc9Rs59aXAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285250, "uuid": "b558134c-5e4d-446b-9009-4776f5afd15b", "value": 2147463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285250, "uuid": "46119700-d23f-4fb1-bbca-85310c9295ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285250, "uuid": "786d8b95-2e34-4c29-b6c3-d31b896b87eb", "value": "Actualizaci\u00f3n de la Pol\u00edtica del Personal \u2013 Diciembre de 2025.098-79.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b9be32-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298797, "uuid": "be61fe6e-4d0d-413c-85cf-465a07b1ca58", "comment": "Malware payload (Mirai)", "value": "d5706703c8ad1554593003743e4f19db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298797, "uuid": "7e90a6dc-039a-4759-8bd0-d178845e1bed", "comment": "Malware payload (Mirai)", "value": "9ad6c1f6c898ab2730a68f8c24bb4f686e35fa5cd01c94473f2b62b6c2772e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298797, "uuid": "2227d85c-8262-4316-a23a-050f452981f6", "comment": "Malware payload (Mirai)", "value": "11c60b31c4e5f9c66480e04e66dbaf677fe43c7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298797, "uuid": "5caffd77-f29c-4691-be51-37b1460e4094", "comment": "Malware payload (Mirai)", "value": "67121196c233c3dad872a8a507f4621229b2e4f5df4b5a8ee515115298aef0fb17f0b28ad0ff985373917bc56217cc6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298797, "uuid": "902c470f-10c3-428e-8750-bf5e73cc4488", "value": "T13B334C21B9762E17C4D1B8BE71F34724B2E6170E36A8C65E7CB20E5EFF10A4064176B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298797, "uuid": "08ebfd37-6c56-4f9f-bd55-1e1c08430033", "value": "768:3eqo/q9ZF7Zjj90aKNV+k0Jex+VWxstW4pua+zO+96Uf1zKz:3T6SZ5Zjj99KX+k0Jk+VWxstxp3mf1zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298797, "uuid": "23e8b3fd-92dc-490b-aab7-dd66e45743e3", "value": 52560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298797, "uuid": "1b1e6ffa-1c31-431f-91ca-72d444331ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298797, "uuid": "c3696b20-a7a7-477a-b6db-38bad78f523d", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090d339-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298420, "uuid": "1c7b9ef1-fa45-4a2c-b3b7-212ab812a1cf", "comment": "Malware payload (Mirai)", "value": "5a8932255bd3c01bd43430835e0e25ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298420, "uuid": "539477f2-cc98-4162-86e0-9ec6d20a123f", "comment": "Malware payload (Mirai)", "value": "9b85d13c02a3d4bf6991284b949b02d52954cb9bdfb9468bb7b2b2aae47f42c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298420, "uuid": "91514e9a-27d9-4aa8-b1bb-7d504c6f5a71", "comment": "Malware payload (Mirai)", "value": "82645ffa97842518669a991d156815d4917709d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298420, "uuid": "0068ea2b-18ca-469a-b581-50c236a1fcac", "comment": "Malware payload (Mirai)", "value": "112dc98dd29df58fdb459ab0e181196c2cc644a4e6df0462f81191ac24ed1737c5b7fe9ce98a8c0a46fbd428e0b551e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298420, "uuid": "37c9250c-44ed-469b-b8eb-0e2611bf1210", "value": "T119234BC49853D8F4ED1929B02533F7B76EB6F43901B8F9D3D794AA32B842611960B2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298420, "uuid": "9beeb06b-44a7-4a53-825b-381ef5bb211f", "value": "768:vHrd4jmK54fIBxlegmf7WpNATcQzNCnttgNE3TO2t6RoueWoL8u1mbF:vHrd4jmO4fIwxipNQzNCIWjiR6nL91m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298420, "uuid": "b7137ad0-a123-46da-a97e-511a4329ebf9", "value": 45712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298420, "uuid": "1a114eee-9420-4e88-8b50-73302fb5e02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298420, "uuid": "e0934ce6-8bcc-41fc-a024-57a37d76fbca", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986b9a41-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286327, "uuid": "a9753f6c-13da-41dc-a5f3-0b111ec60413", "comment": "Malware payload", "value": "0622d5fe7d13ac7a68cf4018a8673e05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286327, "uuid": "691ffe39-bf3b-46c2-881e-6ef3bf6fdd8e", "comment": "Malware payload", "value": "9c3c3c8003423f6076fadbb1b4aa034449229ab0956ae977c42f871c21f81087", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286327, "uuid": "11612fab-867b-4a4e-9c8e-6f30a8838fc3", "comment": "Malware payload", "value": "3f6af5e34cadf35c55fc3f6d20ff454d8c06fd9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286327, "uuid": "7f216b75-68cc-4002-b24f-30e1d380faef", "comment": "Malware payload", "value": "9567e5b2e2fe6429bfaeaa80782a3e0bb230a68298ff9e4a199b93eadcede25aa44a7b1574126ddbdd2bfcbd2425e01f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286327, "uuid": "7924adde-6d97-4591-8ac3-4c1929c082a2", "value": "T18134734063C4B89893831FBB7B1FB6E5F61B098D3448049BC216BCA4B57571BEBE1936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286327, "uuid": "e400cb4a-b824-49bb-b7f0-f8f09e54a198", "value": "3072:6jkX8oHmqSiexAgF2uO1Aval3nlekVNmEqBN5t/Z79u:6O8oGqxeSU2uO3EkVNmEQNj/Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286327, "uuid": "6d6c8517-f41d-40d1-b971-4dcbbf74e2c9", "value": 234500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286327, "uuid": "4f55f9c9-1ec1-40ad-bf24-ace62e81055e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286327, "uuid": "69e18e83-2323-44f6-9bcd-ea6ae51b615b", "value": "Purchase order PO3007189.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536ad664-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765285782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285782, "uuid": "d3217718-3322-4456-b86a-61018796bc6c", "comment": "Malware payload (Formbook)", "value": "e419f3f03eb5034352a9c2da8e34e26c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285782, "uuid": "2b8a6dab-2d4a-42b4-a9cb-fdac39efcc38", "comment": "Malware payload (Formbook)", "value": "9cd5e29bbd76c3074ff077844d6984932eb2968c82f369ea3c2b559130564a94", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285782, "uuid": "f797cdcf-d9fc-4e5e-af02-b8924f960e92", "comment": "Malware payload (Formbook)", "value": "7163981406fa63c4d9375649efafb645749b048d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285782, "uuid": "596e1adc-4907-4a1c-859d-62818b419513", "comment": "Malware payload (Formbook)", "value": "f2834d7571abc2d6e4d8a1dffd900cfad9137444c151b701ceb5cc77575beb8cb58314504c38020ec20bdbfbb35e32f5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285782, "uuid": "e80a87dc-4ac9-419b-8e33-317323bcf31f", "value": "T1AB553320DD8A6CCA4568C36C127F172FAA69AF809CEDF2D7735C694103EF6359297C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285782, "uuid": "473b9866-99e1-4876-8d07-5986207eac64", "value": "24576:evw8heVJC79cX9qGNCjkLWm9Qx7ULJxMAn3bTMb7pFH9e3:H8oOGXUWCjXROXMXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285782, "uuid": "5452ba99-784a-4e70-82d0-a59999b98c0d", "value": 1390348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285782, "uuid": "3ca6c98f-c625-4ede-8151-dbc03934a30f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285782, "uuid": "3439cfb2-fe7a-457e-9d27-567b7e65e6b4", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53739d97-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765278910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278910, "uuid": "91e5b19b-45e8-4ef9-9886-6da8a9e8059f", "comment": "Malware payload (XWorm)", "value": "4cb911933bde2ad9c1d6ebdf49e9b0d9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278910, "uuid": "d869a76b-de77-4e0e-821f-c89155a9ff15", "comment": "Malware payload (XWorm)", "value": "9ce6f4d5a77d9ee2e7ff89b5a68b3665317d0338ac13f241bc01578953c0ceb9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278910, "uuid": "af8d532b-e48a-45a1-b91d-e9305f577384", "comment": "Malware payload (XWorm)", "value": "e8fcdd48292891e37c3062765888989089d38c93", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278910, "uuid": "dc917e80-72f0-4438-a008-b5f726e78c23", "comment": "Malware payload (XWorm)", "value": "860c7cb858bc6cc55109f38806242af9df88e8e6a4657a85cefa73d824b686c892e89056cc99ac28a389ac8c233153a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278910, "uuid": "98602c91-ba83-452e-8d11-5033b307383c", "value": "T15DF54B03F991C9E4C0DAE239E476A296B6A53C084F3037D31EA17E695F363C86C76725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278910, "uuid": "41cbb795-bc49-4603-adf8-6dc43ac89b56", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278910, "uuid": "3d62aaea-7414-48d0-b0db-a790204f4be8", "value": "24576:EZlBv29yTocVYcptvE9stFlFB0n329LrWi/dTpA+aS8lMfjeleN7842+B31+:EZjugTLYQaslFB0n329Lr3/d9AWdti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278910, "uuid": "8f9be785-333b-4ab4-ab54-a6508303e8bc", "value": 3645144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278910, "uuid": "c5c87385-c53d-40d2-8a9d-4ffb03d3bbd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278910, "uuid": "759f5283-f4d7-4367-be5d-b3c58d1a9c4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d306fa68-d526-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302317, "uuid": "2a2a923a-c992-4ea8-9216-6ae74b3f84dd", "comment": "Malware payload (Mirai)", "value": "070e2e2f305a1e4c7a9f9494720129d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302317, "uuid": "9c53faa3-99c8-4445-a9a6-ba3db710d1a9", "comment": "Malware payload (Mirai)", "value": "9d4717706b6be74ee174eea59f6858452af5cb2bdba862e6b8c9428f638552bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302317, "uuid": "d1ac5162-5ce0-4ae1-bec6-c2764bc3cf84", "comment": "Malware payload (Mirai)", "value": "8d80ac501a7a7eb5d79b6e12044191d32ef13073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302317, "uuid": "34fd6e3d-6424-466e-9663-9f3839a77d2f", "comment": "Malware payload (Mirai)", "value": "8b604407ca40579876bb0f19b0a3fff42f9713865a68c04abf91c8b5935c8bd1e4395e2b3d8c4663baa6caa4f2a822d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302317, "uuid": "5089309d-73f5-409d-9544-6a7721e13f72", "value": "T11B536B4272184A57D5A709B02D3F27E2C3FBAA6021E4B3CA641EAB5E4675E331447FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302317, "uuid": "b5b21772-f49a-44e3-a46a-860234ac9613", "value": "1536:mB4n6NcyJQmDDM8Rv2YwRTvbYouP+SNT3bsRf:mB265JQ+v2NTv0PjNT3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302317, "uuid": "6311ed09-9e33-404b-94f2-98257fd0c9d5", "value": 64720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302317, "uuid": "90553eda-ad3a-4a96-9dd4-3def25783b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302317, "uuid": "01df57cd-46a2-4634-90b3-58a59ae230d1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e18116a-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287921, "uuid": "58110366-248e-4f89-a1e2-170edbb4a15d", "comment": "Malware payload (Mirai)", "value": "7d7bd7740c4f9fd780f9e67d53689ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287921, "uuid": "35cd0367-955e-42da-aba8-4f96a1590100", "comment": "Malware payload (Mirai)", "value": "9def4719216555b05e39569f071c86d815b52b358622ff806998f518dbd72b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287921, "uuid": "f8eaaefa-f334-4ebf-a951-eea243847257", "comment": "Malware payload (Mirai)", "value": "d50b77320c305a2a5329332ff87d6d198c4cba73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287921, "uuid": "7f470df7-3ed5-4d8e-b7b2-2058dac9d212", "comment": "Malware payload (Mirai)", "value": "7d7f4312129b8a10d1af4be45c11ce124a325eb02858df00a75a7d4a33e51decc9b2fb3f8586b31d1267bab0a15a1022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287921, "uuid": "7709618f-89fc-41e8-83ca-7cb33fda8c15", "value": "T1BC537CB2C02C6FE4D1489DF075788ABC1763F90894573EB2A657CAA91483E9CF144BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287921, "uuid": "8d0956d4-b388-4b61-b9d0-2d030bd6cc07", "value": "768:4wdPb2DrDGLjaTzXRn705oR/uAXeOlIAHyjFvhHIHAgW6VRJn78yE:4wdT2fDGPkXRgGWAOOCxtIHAt6VRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287921, "uuid": "70e849e2-765d-496c-be3b-0bf7b2d7934a", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287921, "uuid": "752fa91d-31ee-487a-84f3-e492ebbf8fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287921, "uuid": "edbca3c3-e6a5-4f18-afab-b3880ff4ac74", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a89267d-d4b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765254441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254441, "uuid": "fe6febbe-249f-4d0b-aa75-5e60c6ceb5a0", "comment": "Malware payload", "value": "9edd5b6bd98a2fe36244e9003291870f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254441, "uuid": "89c4f3d8-1124-45a6-a799-506fcb124a5d", "comment": "Malware payload", "value": "9fc0e1c4b0843fd4408dad69fd76031a1cccf8020f2ac416e07d73783364b162", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254441, "uuid": "b2d55a35-c78c-41d3-8423-ef71105bbca4", "comment": "Malware payload", "value": "af69d87cf7667728a97725011a403659dbe226e9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254441, "uuid": "fba482ca-a566-48a5-b6e2-53f14a70ca4c", "comment": "Malware payload", "value": "fcf8a3257d80812f0699133d45ec0e67d7350578caea8e621d280b3a703596ea67183910ed9c0770745650420c080dee", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254441, "uuid": "89591955-dd2e-4202-be66-f08138dd0730", "value": "T183B6E891BD964565C67BF134E1A0622176707C1943313EEB6FE81AB90C2BAC4273FF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254441, "uuid": "7263f7c5-1bcd-472e-ae33-75a407dadc6e", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254441, "uuid": "a08ed96a-227f-465b-9758-6b2d5c5cd330", "value": "49152:V+8g3/Qh8UtgYHuQx85XolcoSdhcurex2DbzN7MI3WbOupgWi/w5KLN+W4fnMBeo:m3/CCoSreBeIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765254441, "uuid": "4d20c831-1660-4c81-b6dc-77fe0e2679db", "value": 11106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765254441, "uuid": "ee5cbd84-d53e-4b91-b0c6-da0e31419d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254441, "uuid": "989630c6-0364-45ae-8d07-a30b2df1c14b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f4a16d-d49a-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765242212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765242212, "uuid": "cfb1f02d-9a09-4a5d-ba60-c01ca7118ba3", "comment": "Malware payload (MaskGramStealer)", "value": "5d73d8101c4fba1bee700006a81f09b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765242212, "uuid": "55ab888c-c7b8-4404-ac64-8fe9f137c4db", "comment": "Malware payload (MaskGramStealer)", "value": "a176b78b2091084a3392fea82983c7fe6a40a6cdad484782a4c137603e1aeca2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765242212, "uuid": "8985e997-bb54-48c8-b7aa-8a8e6688e5d6", "comment": "Malware payload (MaskGramStealer)", "value": "fe4732667d8200a6ab3680e4e97a42fa3ac8dac9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765242212, "uuid": "f80fb045-e72d-49ff-847b-2cda1a502860", "comment": "Malware payload (MaskGramStealer)", "value": "ab36c1b0dd377e6eb9537943a7bbe3b6a321947acf6f492484761baf33efc425cf6d74f232cc43bdbe645dddce69169c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765242212, "uuid": "46c373e0-c3af-4d61-bbba-d9783565b515", "value": "T19BB623A6DAD953A8D0C34A50A28656DE70C0755E83EE9C1D3FCF5C023671CAB824BE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765242212, "uuid": "bcb619f6-7313-48d1-a8b5-c1049ee1ba03", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765242212, "uuid": "b883a236-5edf-4aa7-bfd4-11a7e9d5ed1f", "value": "196608:lGMrYTbUh7iBHmRhRRmtU2kyJ4DV9h65KPeZewebDRaszOVyig:0M6YkBGrR8tCya5yKhbksq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765242212, "uuid": "f3833c92-b58b-4bed-99a4-f5d8c1878f7b", "value": 10887680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765242212, "uuid": "21269d05-b9c2-4408-a5d2-7431b764e3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765242212, "uuid": "16369622-0544-46cb-b84e-c8f60118aeb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a7d223-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765286022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286022, "uuid": "b6f18f9b-1a78-4c25-a0d5-8c830b557d57", "comment": "Malware payload (MassLogger)", "value": "7fa170475f3358423585fafa46babc6e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286022, "uuid": "0f1be5c9-c3a3-4c47-89db-adcb6d848a4c", "comment": "Malware payload (MassLogger)", "value": "a2c3177b3e4bb5a23118e2583a17e5de741193045f424c4dc23719a114574280", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286022, "uuid": "bc8088e6-15bd-4995-9af5-9fb5b9ce59fb", "comment": "Malware payload (MassLogger)", "value": "eca9df6536469d668f3e8acf0c44c9e588658d4e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286022, "uuid": "4f11ec88-b4b3-4210-b65e-e3e96d8b35f8", "comment": "Malware payload (MassLogger)", "value": "f06b92caf00bd285a90139fa82cf17d2c936e37ef8f2ce6414be353d2a78f671b9f497186d06c33e7d9bce851401a602", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286022, "uuid": "d9a65aa3-63b9-416e-ac75-fa2338d699ef", "value": "T128A35345A2C0B8A9238B1F76B72FB0E5F93F0C9D7594489BC111FC90A5B5706DAE1E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286022, "uuid": "4e90c7f6-b756-42d3-9233-f72e3210160d", "value": "1536:MCdKgoXHbCVWDCVxCeAW/tmVcA5cBtogLfj81F0aN3uqT6Qv4Bj:MUZorsWPqFmUrj81Ft+qT6Qv4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286022, "uuid": "a062ae3d-704b-4511-be02-aebbd638179a", "value": 101723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286022, "uuid": "e9f1ff60-3a2a-42f5-8686-96bc2a3fe1f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286022, "uuid": "13d62b53-e718-43b3-a442-378b866e353d", "value": "TEKL\u0130F VE F\u0130YAT L\u0130STES\u0130 \u0130STE\u011e\u0130 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a620cf8-d548-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765316691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316691, "uuid": "4d8e73ba-62f3-412a-94c4-8488b794d245", "comment": "Malware payload (Mirai)", "value": "c3cf8126bb32bb78244cc59659fa6964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316691, "uuid": "c68c3c60-7296-4cf8-9d6b-45913dbc33c5", "comment": "Malware payload (Mirai)", "value": "a3a92d2969d0253930604940d7fb567f7dc6c5edbcd6bab30b925de905b76309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316691, "uuid": "5a953de3-4ed8-4427-b5b0-ec1f53dc1d78", "comment": "Malware payload (Mirai)", "value": "a4a34b886688262b2a30b2a0286f2688ce70217a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765316691, "uuid": "676b6c7c-6625-4138-8d7e-02e9339347d5", "comment": "Malware payload (Mirai)", "value": "aa2119d614d5be19206e70c36133c9c8ec96f75cfb0ac5c8df13bf8a146867f60da2c35525b2743bffdbf7c7985b9db0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316691, "uuid": "914a3005-c009-434a-bcd9-d68a979e05a3", "value": "T1B1445AC7F803C8BDFC4B96BA482F090AB430B75154535A37B3A7BD66AD3A0D25D12D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316691, "uuid": "3e65a4d9-c1dc-4f06-bfe1-c709203e7525", "value": "3072:9zSDTXiBB6R+sPgzckP0PNbJSfyvf0l/ZAWLgfSw1h9gjOVDjbigLunwHV/6n:lkTXiBBSofyvcl/ZRLMdgjCLKiV/6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765316691, "uuid": "5d591f63-6053-4b59-93a2-cea3298df83f", "value": 260384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765316691, "uuid": "97a52372-9ca8-4e48-a9a3-82d5f97af242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765316691, "uuid": "df9e8728-6b6f-45d8-8208-c45ae333d5e7", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40224fb4-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298205, "uuid": "112f38a1-0b49-46a2-92fc-971d7ab3b99d", "comment": "Malware payload", "value": "b152c3d78e800287c245d8d8ed5d44cb", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298205, "uuid": "043c36f4-8a22-448d-b837-e1de057736a4", "comment": "Malware payload", "value": "a4ad7603de2a28d37031cf029e1862185dbecb940b0e7518246c57d908379c3f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298205, "uuid": "8f3e9c11-efaa-4849-a401-1578107498bd", "comment": "Malware payload", "value": "8899028d716253b5357843695bf1747fe88cd2b9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298205, "uuid": "f3bf0510-caf5-4354-b482-949bf172b229", "comment": "Malware payload", "value": "101c890595923017fe2186482ba8c37db5031a897f90a477fca705e5e46d61543648b5e83dbdac9aa0a686e9939e2319", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298205, "uuid": "9dea531f-9ff7-40e2-9e0d-3068a65c2632", "value": "T19EF533AD3FCA35A72D5F0042C979E61C59F9406669046F5F6B82A4DA9B3C8E7480F233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298205, "uuid": "431815d1-67df-4c7f-a3aa-1fa932462c9d", "value": "98304:mfvr9mu7W6/I6965agDz7qHo2Afi8sl3p:YRmsWaEtso2Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298205, "uuid": "73fea08b-751d-4341-b71c-5f0b41622c42", "value": 3347916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298205, "uuid": "63c1af75-5335-4167-856b-a7afc6feba78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298205, "uuid": "dce0ca98-f72e-4d33-b6c6-127cd895b52a", "value": "k.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4323bd-d494-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765239304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239304, "uuid": "b6ce6171-7d7c-4c39-81bc-0506f9753b97", "comment": "Malware payload (QuasarRAT)", "value": "bc1268d92af4fa96a5ab483bf8c44a3c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239304, "uuid": "0c0a791c-49c5-4077-9526-f700237280ef", "comment": "Malware payload (QuasarRAT)", "value": "a4c36a7fde33b069aa436c820d1dae65fdf29c18badef68d9e010fe8f4f13435", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239304, "uuid": "e2ee1eee-1aa1-48f7-b091-2317ad30edb0", "comment": "Malware payload (QuasarRAT)", "value": "58ae987ebc0dca1843b59ef64599cdde8c792ae6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239304, "uuid": "19710d5e-0a2f-4b39-94e6-69a2be1b336d", "comment": "Malware payload (QuasarRAT)", "value": "e0e270a5970082d0cf504bcaf5465141b6106c6218bdab5d5fe35b85961c7663d0b73846c6f1cb2278abdc1ac87ab115", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239304, "uuid": "8bb3a2b3-c2bf-40ad-b006-be06cb1a1d21", "value": "T1401633519EAC5F6F4BB8A66C307F0C0B13F08E84501594E99BE6DCDE929EF84071B62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239304, "uuid": "c344281e-2edf-4a6a-801b-c833edc96e79", "value": "49152:cX96J9Ovx5MHLubdDvp/63jsM4jG92gzzFHoKllw/OxH4mqXx:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765239304, "uuid": "0b5f260b-2eb8-4c01-96c9-e2b3c0b759a8", "value": 4383895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765239304, "uuid": "823764cc-373d-4a5e-aa66-d3bba04f9567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239304, "uuid": "b6386e69-bf9f-409d-8256-27f7ed2fb173", "value": "startup_793.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ff99c4-d49e-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765243749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243749, "uuid": "e12500d0-fd0a-400a-af14-f70fff721738", "comment": "Malware payload (MaskGramStealer)", "value": "c3226a810d8f6e94cd9147e62299300a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243749, "uuid": "02b13408-5426-4b27-823a-84dbdff2c976", "comment": "Malware payload (MaskGramStealer)", "value": "a6350431eba4ad212f2646507bac3eadd32d0b1ebe068934360ff337286457bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243749, "uuid": "036fc126-d5b6-47f7-86ef-96855942cb76", "comment": "Malware payload (MaskGramStealer)", "value": "8dfaed237f6e6da411fa6533c3101bca95596fec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243749, "uuid": "355e6c01-331a-4a35-aaf7-4f352b2f19e6", "comment": "Malware payload (MaskGramStealer)", "value": "98214f04aca1fba1e8ee27e1d67632fde642c20c867b82ca55ae46088f8b4f998ba90cb88e04ef5f149b36fe04ca45bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243749, "uuid": "45212743-6c5f-4fbd-a5de-de7aa052abc5", "value": "T18CB6239699DC92E8C4C34A54668B02DE74D1B65DC1FE4D2D3ACF2C036A31CAF458AE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243749, "uuid": "33ccac56-5bb5-4dff-ad9e-f96420137b98", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243749, "uuid": "8afa98b1-388c-40a0-b016-215d73f8ca33", "value": "196608:DJF7iF7UoKe/jH162Y0FelctaJ/NEP6sszvxl4hdxy0:Xk7h7T3elsa66bzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765243749, "uuid": "df2d6815-1574-495f-ab56-feb59a7abcd2", "value": 10724352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765243749, "uuid": "6f2a3404-8b75-4802-bb65-aacfbe129414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243749, "uuid": "86e1cc23-8fe0-43cf-9830-74a57508fae7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e93615-d516-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765295212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295212, "uuid": "f2aaf008-f1c8-4c79-8888-f64cd28311c2", "comment": "Malware payload (SnakeKeylogger)", "value": "9b2c0ed4ae2ae12092aff202ddec3975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295212, "uuid": "ef9f7394-2c2d-4e52-9594-d4bdfd25587b", "comment": "Malware payload (SnakeKeylogger)", "value": "a6845ce1eab253282556ab7bed1ee055703ea0b3821f3afacdddf9b518c8ac62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295212, "uuid": "b5171f1a-b7b0-4eaa-ab11-eea545d9e0e4", "comment": "Malware payload (SnakeKeylogger)", "value": "2c456a4e903919aec248de4a95a05efbb7c9695f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295212, "uuid": "6d1486de-d0f7-4ed3-9121-aa6e8a0aa817", "comment": "Malware payload (SnakeKeylogger)", "value": "178932d37b6856bc78826532c6509a5623ef622a75c0af1c8f8d6d812b204bf0f1376121c2f2978571f13ef7a41416eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295212, "uuid": "901fac10-ea8b-4c1d-8ced-4a61aea904f8", "value": "T1CE05F1D03E2A7716CE910A31E678DDB683F92D697400BEE669DD3B9B359C2109D0CF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295212, "uuid": "f81de9bf-514c-4b0b-ab93-a7e4ea8f11a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295212, "uuid": "463efefe-480d-4b33-b370-f25cef6b6070", "value": "12288:fMcJm86OKAX0rljKq5V7u63UYSl7XVW5N5dUUHU4ybTa+6A6TP0/O1M0JwkR:fMdzrljKqb3UY4S1UDbTanTXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295212, "uuid": "c75880ed-5222-41b5-8671-6097a83ec16e", "value": 860680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295212, "uuid": "5f86edf8-a06b-47c6-af3c-2e6f0191d9d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295212, "uuid": "ff6c1d0a-4800-4b93-a0e2-a2c68436367e", "value": "Okbmedikal AS Sip. 79290011808317 DIRECT 140 HQ ISB1870418 NTCR SD09 Acil M\u00fcdahale Sedyesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7b448b-d513-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765293929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293929, "uuid": "81fb3141-87f6-43cb-9dc4-43ef5d7ee303", "comment": "Malware payload (Socks5Systemz)", "value": "8496c0bf61350742d525f6cf11aba037", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293929, "uuid": "fec476e3-6ae3-48bd-9a01-7e7e75c8a4d4", "comment": "Malware payload (Socks5Systemz)", "value": "a8010bc42e77a0d3a3802a86c06ab7dd5a491b8bc5f4478957fbb8d771e62d26", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293929, "uuid": "c4336481-bd50-4485-bf00-3b30dda71092", "comment": "Malware payload (Socks5Systemz)", "value": "6526db0d522a5b3a8081c51f1cebd37c8b068fb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765293929, "uuid": "0f301291-63eb-4045-942b-4e1b2a61ed77", "comment": "Malware payload (Socks5Systemz)", "value": "055c8f11ab80f63dfe7b25129eff815fc306c5715e731ea733f389a91fc7ad3ea4af26b25d319fca0e0d3951ba2b2346", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293929, "uuid": "cc7f81a3-a6dd-4573-9315-cb7a4d302b3c", "value": "T12EF533E0D951C0B9E5DB99B9EE7381B5873B71A288312EEE35CC0F461FA7058AD06315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293929, "uuid": "37df2009-a153-48d2-86c5-45e3271fd8ab", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293929, "uuid": "e82a689b-9274-4efc-86fb-0dec6aab97d2", "value": "49152:C9hvV+M2+RsuYjtSXvcd/10NMAlx2gNKWyDJmrXzzLP0FaieJVWsussul:MlwM2+i1tSfoYSgNriJu70knCsuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765293929, "uuid": "c5962af4-991f-448d-905e-83ea15ffcbca", "value": 3497960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765293929, "uuid": "e99978ab-4f9a-4b80-a984-bde214af7b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765293929, "uuid": "24274d54-b83a-40e4-8258-f9c365d55eb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c33552-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264422, "uuid": "58461525-e595-44e9-93cf-0d7e142a285c", "comment": "Malware payload (Mirai)", "value": "1b8e1be5feb68c19d2ac0fd38a63457c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264422, "uuid": "24fdf20a-acea-4e25-8156-57d6d35fc03d", "comment": "Malware payload (Mirai)", "value": "a900e0da95fd6ec18cf0598c6fc25db6da280420ca25d4e705d70912e5a423ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264422, "uuid": "203fecb6-4909-4d0f-a9e5-a1cb5e78e08d", "comment": "Malware payload (Mirai)", "value": "19081b4fbd854fffedc25104a881b14b5ed2cff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264422, "uuid": "5c9d43cf-2af2-4581-bd43-925af5412172", "comment": "Malware payload (Mirai)", "value": "796534f7d7358654432070a8edd00fbefe10b5bbd91be1428dd2c4514fee8075a40afaa45320775a55f6155208213568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264422, "uuid": "418570a2-bf29-4a1e-998a-d76de9a11bee", "value": "T168057C42FF1C4522C9570EF0193F43D5F7657A4341F4A22A270F5B672222E3AAAD778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264422, "uuid": "2d9a0743-c6e4-450a-a0bf-57f733162ade", "value": "12288:cQ6mSu8DIK/rCIHKrtdoDTESNlVDIWPMvSgr9QxAYmep26+UuPpG5Q3CnZPq:cQGFDIK/rCIH7Dtb2WW5017GA+gZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264422, "uuid": "87826741-1185-4453-a54f-42d4b0b296a5", "value": 854796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264422, "uuid": "2bd97b04-19f8-4326-bd46-3a8d8a449cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264422, "uuid": "9d367f4b-521c-47d3-a72d-ccdb46fd2d95", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c1f5ff-d521-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299854, "uuid": "e234e71e-0fe9-410a-b53d-e972760744ab", "comment": "Malware payload", "value": "5be4039dd5fd28a11bdd4c3901e167b9", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "buqiwptshpqisy-com", "colour": "#C9543A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299854, "uuid": "885b0ece-0698-40d3-9f82-81e115fe5081", "comment": "Malware payload", "value": "a91e84a616f495f5497d113b718f419713ed1581d445daeb61b5297ef4a05fb3", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "buqiwptshpqisy-com", "colour": "#C9543A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299854, "uuid": "f0ccbd43-a78c-490e-b45c-bfc3f264a78d", "comment": "Malware payload", "value": "b1393100c9a4f4b154912f0c405c6490430cf2bd", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "buqiwptshpqisy-com", "colour": "#C9543A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299854, "uuid": "d54c954c-d408-4bd0-83d0-e0e757dbae60", "comment": "Malware payload", "value": "626cc61c0b788cdd75cca26c579f79868e2a68336d7b1ace3b4c8cb56bd189677909df1fab00062baa17a3b28964a075", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "buqiwptshpqisy-com", "colour": "#C9543A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299854, "uuid": "0a1bfbd8-4b33-431e-9cf4-2e6638d269d7", "value": "T13EC0806B5155E2DE4F42BD86D0ED6630C01723051720D091A1B98F187918469D1891C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299854, "uuid": "504beaa3-c5e9-48dd-9bb0-e2616e5ebd3a", "value": "3:VSJJFIf9oM3KbQqPJH0cVEReMzqrF13IetmAcLhzAK5DjxjVXGMHn:s81R3KbQO0c5I48zD5vxtHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299854, "uuid": "0ce0a691-2183-46fc-b60a-f17e154f5f8e", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299854, "uuid": "0b171575-d3b0-4c89-bb3d-8fdfd5953f7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299854, "uuid": "337db64b-4003-4496-aa77-5f9226198002", "value": "ads.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c65c5e-d524-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765301276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301276, "uuid": "0f05df0e-b941-4eb9-9494-91af653f7e97", "comment": "Malware payload (Mirai)", "value": "0ba79f9749ce589ea3527b7078b84807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301276, "uuid": "d9c3899c-72c7-4153-9c7c-af2a290c0147", "comment": "Malware payload (Mirai)", "value": "a9e5d840077b7a9786ac6d06ad0ade5209a8082d6685fb0d34af8c44bbfab6e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301276, "uuid": "6d509c07-315f-4f61-8214-c3cfae46a29e", "comment": "Malware payload (Mirai)", "value": "525446059e31d149b45217c58f69139dea949c48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301276, "uuid": "c361e7ae-c70b-4652-a6ea-cfcc688d9be4", "comment": "Malware payload (Mirai)", "value": "21b841df548e6d35599109d78f71afb6a92414add1981b9030d4c84be3988cb87aaf87a2581bc5ae00c4be077ffc95df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301276, "uuid": "f5f80b2a-06fd-4b45-b670-57ac4c775166", "value": "T164133BCDC943D4FAEC2819B518B7A7325736E97918A4FA82EBD9D531FC02A05B1063DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301276, "uuid": "61d8479c-f0eb-4fe9-bbf9-3ac96b1123fa", "value": "768:iLA+xfGz/zhZ3m8vLWoZrq/k+6gsEf9YXT9KvxjI67mQRiz:i0pz/zhZ3zLWoZe/kNayXTo5067mQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301276, "uuid": "7a777f2c-39f7-4b01-b625-422f9892e52d", "value": 41924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301276, "uuid": "d3fa8300-5535-469a-b516-3f07a19f1047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301276, "uuid": "28281a6a-76c9-40a9-a738-46dec9f29a1e", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755d3795-d509-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765289704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289704, "uuid": "c4ab21bb-8941-48bb-ab8e-dbc04868b51e", "comment": "Malware payload (Vidar)", "value": "374f14f2108f569d41de18c5c41476c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289704, "uuid": "85cf6731-c840-4416-a6ee-77814eeee7aa", "comment": "Malware payload (Vidar)", "value": "aa1e68fbb3dc32132c6e255da76a704970ea65dabc7733b80fd5ac1104dc541f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289704, "uuid": "fa4bc035-5f6b-44e7-bce5-fff2b75b6adb", "comment": "Malware payload (Vidar)", "value": "9b9da961515f30bdc67f1dda600cb564209da16f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765289704, "uuid": "7e057245-4f35-414a-8c8c-8552b4b02e46", "comment": "Malware payload (Vidar)", "value": "59ad9b9b96ed35ccfef64969e0aff07f72d682d6590e08922246a65239c30f983239edea557bad3b895f46631be72c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289704, "uuid": "f4e56677-e3a8-4dc5-bc97-1400385a2227", "value": "T1A2E623D33AC6936CD4C78E34528E0B5971F1B3CC89BB6A2B37C65806B630E938945977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289704, "uuid": "74519741-0325-4bc4-807d-87c84b028e2f", "value": "860714c41d4908a0b78d349f3d9a82a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289704, "uuid": "fa50bf31-460b-41f6-9822-e5a4a3322c3c", "value": "393216:qqioT6ZpMqTYBV+ytWRn8dr+aNkLk/Nsd1E4qL:Di7p9IgZaqtnE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765289704, "uuid": "bee4d9e0-775c-4d20-afbf-a620c8451df2", "value": 14846976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765289704, "uuid": "1e715553-04b6-4b77-88f4-d9dba9263114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765289704, "uuid": "05657696-ff7b-437e-8505-7b18371b405e", "value": "ValorantHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92df6a93-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252388, "uuid": "37eac808-d578-4afb-8861-11baa3e3ff71", "comment": "Malware payload (Mirai)", "value": "44839b0015dca02b75b7fa4856791a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252388, "uuid": "cdc87f84-8bb2-4469-8043-e708823b8a23", "comment": "Malware payload (Mirai)", "value": "aa53544dff8da222f16d1659fd193dbbdb675dfd2bf8cbbedbffc9c7287a8d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252388, "uuid": "46c0a1cd-52c0-4a6c-91f8-de03517366a1", "comment": "Malware payload (Mirai)", "value": "9e7ce7cf5d8ab7d79b978ff4e3cce630f569a545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252388, "uuid": "bea9752d-36e5-45e1-876d-cbfed206ea10", "comment": "Malware payload (Mirai)", "value": "171da382592f7500fdaefc2e07e6376947f96d1f69d30fbda207bd2a6b950981ac7aea756a0e1a652c245526ae9b72ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252388, "uuid": "3b3c897b-b640-4593-adf3-99ca764edc37", "value": "T12114B50AAF610FFBD8AFDD3706E90B0625CC650722A43B753674D528F54A64F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252388, "uuid": "acc3e294-e3f5-4fa1-afa0-ed894c05d24c", "value": "1536:KJRPaM6E1d4xkulP5/pVgr7f1qVAo+6vCmyjo/hYlUTqZv/VTdbkYoue85U35txt:GOx3Rb4s/Cbpr6CU3BuSo79piqulF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252388, "uuid": "0af49697-4239-480b-97c1-d69512f59305", "value": 196864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252388, "uuid": "a5431ccb-5dbb-4a0f-9bd8-54bbb5aec479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252388, "uuid": "cceb4003-dc4b-4a6c-90a0-249947173115", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe409e8a-d522-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765300671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300671, "uuid": "e2ecedbc-a554-4266-b324-ec4503a9066e", "comment": "Malware payload", "value": "d23e1ed4333105ba545461357edbb057", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300671, "uuid": "20898f67-3ffa-49ac-9b50-8da6944e3129", "comment": "Malware payload", "value": "aaad04eb95abeb0728b006534291253887d12095e23c5dee28c0c0598e7a06c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300671, "uuid": "cf622dfd-acfa-45e9-b95b-6b59f93d66ed", "comment": "Malware payload", "value": "5b50b1aa7fed233e18f924fa2cc6b637eec09566", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300671, "uuid": "19dbaa43-3088-4b19-bb46-94333f9d9ec5", "comment": "Malware payload", "value": "8b734c83e1e7f5c64e6e2259adddd46807de4f6e7c89123a924d4510b9787233238fa7666c5c53503fbc53e577c848e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300671, "uuid": "c32af3c8-a2c9-4495-92a2-fc2e7914ae4f", "value": "T139F0EBC4670310BA9A4E4C0A5B2E73C2F08B0C6714002A9EE04C9F707F4FC85E23EE14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300671, "uuid": "d5403918-baf5-4b42-81d2-3deb5f3abb22", "value": "12:sgaOZySt0u8SmFe/Y5NFFxNd1BFyT5WT69F0qFteQ9fFswauYXF6:sFOBn8Je/YHFnEcpieQ9fKhuW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300671, "uuid": "925c3fac-3c55-454b-be4b-3d95718066dd", "value": 541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300671, "uuid": "8c32fae4-6247-47b1-98a1-a91d28fcd548", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300671, "uuid": "45d4d9ea-698b-4cad-9715-1c37a79fae0e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46af974b-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287908, "uuid": "28f93fc7-f6c3-4ace-b1bd-42df3e493e1c", "comment": "Malware payload (Mirai)", "value": "cbdfdbf480cde827938cbbfeb79bf510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287908, "uuid": "83783370-ce96-4a38-a253-b972b8ac35b5", "comment": "Malware payload (Mirai)", "value": "aab1c6b08966910146f067b2f0863ec615258697b854a3fe6847f68ff0838243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287908, "uuid": "7a45145f-3bf1-410b-9b41-7701ca185886", "comment": "Malware payload (Mirai)", "value": "4e9835592a15bfb5203c576a62d33ae643896579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287908, "uuid": "08938204-6a97-41d9-95f4-cb72bf0315eb", "comment": "Malware payload (Mirai)", "value": "4c82f3560a81f55882ecf74dd06ba9a01aea132c70589a440ed809ac0adbecc9eaf871d852af4a84d1c6efebecb54486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287908, "uuid": "270747b5-8b3e-49bc-949c-5364e7f1473b", "value": "T166533B0237280D57C1B65AB4A53F17E097FEED6111F0F649290EBE8A5171E33188BE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287908, "uuid": "ab7fd98c-0c51-499e-929c-bcd834132790", "value": "1536:mfXwlqbrXwSxvLcShkEKh/thIvao3fC6W1rGoi:Iwlq/wQvN6EW/thISzr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287908, "uuid": "ba48f15c-87da-4907-8ff1-042c734e2cfb", "value": 62460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287908, "uuid": "f40364b5-059d-4e36-857e-a21c126ddad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287908, "uuid": "1e1332d0-c617-49ce-b8b8-2803ed644001", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b0563a-d503-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765287135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287135, "uuid": "d77034c2-31cf-4d61-bca7-8be2a6a76fc1", "comment": "Malware payload (Formbook)", "value": "dfd3b949da899a772bc7ef5e205cca3c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287135, "uuid": "168fa8d0-16f5-4f57-9aca-75df301a354a", "comment": "Malware payload (Formbook)", "value": "ab3d86305f4078f0ae2819117501acd92493065144970f6c90730a38e0255e5c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287135, "uuid": "21bf292d-815b-4a6d-b354-feed9958d43a", "comment": "Malware payload (Formbook)", "value": "6ac37c62c31516d2c0d75ecc94c9b5674932d952", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287135, "uuid": "e2eed8c9-5f69-407f-bfd1-f83e74c5a5c1", "comment": "Malware payload (Formbook)", "value": "87dcb300247ede776641f0267f0022a420a383447b2aad9b469631968b3fa076b511b32c804a3a10c9d63f1837569af1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287135, "uuid": "fd2da64e-a758-4afc-acc5-5e85a801543c", "value": "T194A5CE5D84B06CD26014FEB4F685FFD7CCEB5385162707520FE4958A2322C83FAAB6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287135, "uuid": "a1282dff-1a47-4999-afed-37bf773ef467", "value": "12288:AZyefpeI7UpymoGhDBu9/KUu53fW4ykxG64m8MklZPY1B3/HIjEQe3n4os1Cdx++:U7UsPiKu5+p+qGES3hM4NP3UoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287135, "uuid": "7d0ea261-3f7e-4c39-a5f1-d0d8ded59ba7", "value": 2120656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287135, "uuid": "0ecec6cc-9049-453b-88ae-9088ac172670", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287135, "uuid": "7d786db8-9320-48c8-a237-506abc14fce7", "value": "commande.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a4af94-d494-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765239593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239593, "uuid": "12eac6a0-0fa5-4cb0-93e9-ead57190e8fc", "comment": "Malware payload (CoinMiner)", "value": "acace3a595726defe09adf2521df9ba1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239593, "uuid": "728cf817-3ce2-49bd-9150-babf09e62236", "comment": "Malware payload (CoinMiner)", "value": "abcfac672ce387984197f68bb8d99c5963ca15763034ec7d37e82ff8275f58d0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239593, "uuid": "359f6352-425a-4966-8a80-be7572a848b0", "comment": "Malware payload (CoinMiner)", "value": "39334da1a177dd2c030ce06c3122d3dd7b71e7a6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239593, "uuid": "19047698-1d46-44e6-ade5-c26cd40b3db4", "comment": "Malware payload (CoinMiner)", "value": "eaa63aa495600149575418d1c64a4e4d0fd23fd7719c3ee312915e768e3f497516b820493a34d259c97d0c2f1e11c5be", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239593, "uuid": "441a8e73-45fc-4c0a-9b2a-2a2c3640ed64", "value": "T1843168F6FD748C743D5D187CFA2C60E51ECBAD7F492D3A8084829D2A424C48CF11AA75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239593, "uuid": "9b3d8f73-d614-482e-957d-d5b524e131f3", "value": "48:hyawlzkJp4/dYYW4lamR6muQWG/HIcoMcVf0:Iaw2J4Em4muQWEoBMcVf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765239593, "uuid": "740f7ca9-b2a0-498f-b261-7aa56622c707", "value": 1722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765239593, "uuid": "18c89293-ed52-4f60-a471-0df387fbb063", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239593, "uuid": "e666eaca-511c-4ff8-8310-7ec0a8bddd7c", "value": "muie.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba044f4e-d507-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765288961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288961, "uuid": "df31c399-8079-42bd-bf9b-825f297b317b", "comment": "Malware payload (AgentTesla)", "value": "82cc963dbc17e22cf2de764d96d60ba3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288961, "uuid": "955ca3a1-e406-496b-9f19-99ab277a215b", "comment": "Malware payload (AgentTesla)", "value": "ac2f4f8374959b0e15f5de755f0686b748a0ca6368b38aadfef4352666f0e883", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288961, "uuid": "62b378ac-95ae-4730-9ca5-43b70d4b5540", "comment": "Malware payload (AgentTesla)", "value": "0b73a9b7201f4c8261ab641aef3c3d6dd36390bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288961, "uuid": "1cf93744-c34e-484b-9427-b874f275242b", "comment": "Malware payload (AgentTesla)", "value": "8f3e7fc410fa9c3a6fc371ac4cf005643e56b1362565fb8494cc9df8e7e3bf63b3e8ec3e7df5970518cb432413a90d07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288961, "uuid": "663fd805-8540-4e86-8a3a-cb0a49c72398", "value": "T16345CF0273D1C062FFAB92334B56F6115BBC79260123A61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288961, "uuid": "44dbf362-4b0e-4b38-b309-9bbf29a6c641", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288961, "uuid": "78e2d532-faee-4c1e-b6a1-59623df6178d", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaD/XiPIrgMYZ7vwK:jPVt/LZeJbInQRaD/iPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765288961, "uuid": "6e6b94ca-07f9-4851-a87c-594704933030", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765288961, "uuid": "43be6e72-629f-47be-9d4d-6d3fd794cb68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288961, "uuid": "7501a1fe-ef90-474f-a925-c5f67352ea69", "value": "Shipping documents BL, CI&PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a658bd2-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300316, "uuid": "c7721d15-9693-41ad-bde6-bb198bb77d1c", "comment": "Malware payload (Mirai)", "value": "4e0b3b335ae3a2662a33af62fd8bc209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300316, "uuid": "6f886046-7ba0-4045-91b0-09c4891b3240", "comment": "Malware payload (Mirai)", "value": "ad61123bc509872ca8d35c77edb8b43717892d39b90da7b2224dbf3fcbdda251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300316, "uuid": "44ab64e7-8120-4d4c-95bc-a86e10d2017d", "comment": "Malware payload (Mirai)", "value": "84befc73518715675500c0be494526723e41d070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300316, "uuid": "30285277-afdb-497c-8858-0f6834ee4e92", "comment": "Malware payload (Mirai)", "value": "4a8885942b385558805201fa5d8ff0a54abe2668bfa443fd73560f01fa3d10c95d660e88281d7d331ae59046a8b7e060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300316, "uuid": "225068d5-7c39-437a-9ac9-98c701a87b69", "value": "T1F4536B4272184A57D5A705B0283F27E1C7FBAEA030E4B78A650EAB5E4676E331447FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300316, "uuid": "8e4007e3-29c2-4d17-8123-fca28c1881d2", "value": "768:57eDC9JQRkogqn6MhILYN7BXhuxbAHLUhYTSwp/oydlyE5uCPvrSF/T3bsR8:cDOyrhdBRyCOw9oBmTPTSNT3bsR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300316, "uuid": "21b1c85f-4a7f-43b0-b7c0-987563ddc7ea", "value": 64688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300316, "uuid": "4212f20a-226d-403b-9d1a-2d8030956e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300316, "uuid": "da0d0693-089f-4107-9bcc-4aed03a9bb2f", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c6a160-d50b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765290477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290477, "uuid": "46215da5-74a0-4509-b91c-c18cdc9aed19", "comment": "Malware payload (Vidar)", "value": "b350b9c373bb70dd12c17215cd06afff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290477, "uuid": "251ca9ab-33b5-44ac-9fe4-e70502a10eba", "comment": "Malware payload (Vidar)", "value": "af20131da787b6601063a2fccdc7afe6a726e14f6dfd0972a6d6165a427b3f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290477, "uuid": "1d3ec5e5-a088-4f31-956a-65a6104e6b55", "comment": "Malware payload (Vidar)", "value": "c1ea7fed46f36057e691a7397f2c4453a9abf5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290477, "uuid": "81fc4e82-e690-4578-b9af-b1657720c509", "comment": "Malware payload (Vidar)", "value": "c01ba07f93451c28413d9e7fea445d27a4b70ad9c9a8673efea72611bd5ab106e85ec07fe2d5188f8df805288c5c49f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290477, "uuid": "774b054d-566f-42d2-a01e-4df0ac5d4acf", "value": "T13E864B42BA914A29C6AAF235AC71225173707D59433237D36FDB06690CEABC4273FB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290477, "uuid": "480d4ea0-ff0c-4dfd-8194-554ab9e7fb20", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290477, "uuid": "3111a8e1-7d60-47fa-ad97-85c8b0bd33e8", "value": "49152:ned5z+ay3Una4ku/zsclbzK1NkUTIx0FN/6HcS9+/KmuxyT3wl1sF3IxvB8LK5wa:nay3U13M/dLnhExT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765290477, "uuid": "8b91ab06-27bd-4b09-8df3-c6790e2202f3", "value": 8312472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765290477, "uuid": "50c57bc5-129e-4648-826b-5ef85b0ea246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290477, "uuid": "7841cd96-463d-46d3-9642-3f8c94538c4c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ec38ed-d50f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765292474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292474, "uuid": "9a6faf90-e635-48c8-921d-7a9620ae1564", "comment": "Malware payload", "value": "5000898332df1738ab331a298dea9006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292474, "uuid": "9636e501-de26-4a20-b755-b2064186eac9", "comment": "Malware payload", "value": "af36ee498149a28b1bf43ac9e92344941846d506876ad521a9b22880d391993b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292474, "uuid": "bd0b95c4-67b6-4413-ac69-5db05c9c566b", "comment": "Malware payload", "value": "01bd34ce221667d993fbe64e8e0b290ddee48ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292474, "uuid": "68b0a9a5-d452-423f-ace0-d13c8b7d9301", "comment": "Malware payload", "value": "4ae02791e04a51e4af1be3744f0cbb11b0c1dd1f696acc7e8d7a193928355003ff1b3ff035e1a7c6a4d1f991a46cbdff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292474, "uuid": "0fae157f-642a-4bc7-9783-677ba1f82ee5", "value": "T13CA61892BA864D65C5ABF2359460625377317D1D43313AE3EEE80A6D0C2ABC4273FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292474, "uuid": "582523ea-1994-461b-9f43-773d2b51a1dd", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292474, "uuid": "95534f05-9617-4bb2-b4f8-d82a4bcf44c2", "value": "49152:5DKW3jnLF1FA7tZ494JJbGy9/JRYuWZ3K1Y:YW3jLu/hJhp9/3DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765292474, "uuid": "06216fa5-805e-4eab-b827-e0a84c2d357a", "value": 9669248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765292474, "uuid": "a2c37512-ceda-41a3-9bcb-038113441f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292474, "uuid": "b2a334f9-6da2-469f-8ed2-cc0cad2d3f7d", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7241664-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1765286003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286003, "uuid": "38b7cdb9-a6d9-4cb7-ae5b-2882cda8a828", "comment": "Malware payload (DarkCloud)", "value": "cfadff53ebeb82fd0e071670eb25a596", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286003, "uuid": "ae880299-c390-45ef-b206-f676673c3ac4", "comment": "Malware payload (DarkCloud)", "value": "b12c98d881e6aba0bf4a32b2456cacf0ced91002148caf52f5cb316f145d69db", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286003, "uuid": "5d2c58c2-47d9-46ed-9fd3-4fa761115c45", "comment": "Malware payload (DarkCloud)", "value": "ea5b518f1bbc063faac7f0210d4af11b833603b0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286003, "uuid": "d71e9268-2e4f-4ef1-9a86-336d3a4b8e70", "comment": "Malware payload (DarkCloud)", "value": "06e2ec308f3e474817dace85480e8161edb755075140af199207840f65de5832d323f96f87cb3003e081b8adc902142b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286003, "uuid": "9d95df11-1c17-4bf2-b7d3-d3c5b5588983", "value": "T16A1612758F43058506D8A246AFB0AF8C6D9160FF4839859CB17253DBEFD0AB1F4CB4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286003, "uuid": "19166d5b-aa1f-44ad-8140-095ef386cba5", "value": "96:iffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffW:eiFUj0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286003, "uuid": "c8fdad7c-3b00-4353-aa24-b64574985081", "value": 4214322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286003, "uuid": "69daf842-4b6b-476e-b8eb-454bba5fe914", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286003, "uuid": "815fa227-d912-471c-849c-f7d9f385e0b4", "value": "Local Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db12f481-d4de-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765271407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271407, "uuid": "952aaeae-2beb-4de9-a2cc-e336876bc5d2", "comment": "Malware payload (AsyncRAT)", "value": "fb194e39e03019ecfa63ed9ac87f6a66", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271407, "uuid": "6bfaac8b-f2c5-45df-baad-6e8d45de076a", "comment": "Malware payload (AsyncRAT)", "value": "b1b6cac92176659f2152593675021229fa1b0d2fd3a814e4416fa1603e8dc774", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271407, "uuid": "911a8ab5-f253-4eef-858f-10c8a108ffe3", "comment": "Malware payload (AsyncRAT)", "value": "3a8625b0b00f934cf235f9a3b23ef5e9257e6659", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271407, "uuid": "20947cd0-2254-4cd4-b3e1-70a6fdb8081e", "comment": "Malware payload (AsyncRAT)", "value": "86b71439d0b2db052068c10c483cfb5a8c009fdb2021092e1acb2e77bc0b083f5ea5136ad5cc73a9d35efffe590a91c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271407, "uuid": "3a451053-d340-46ea-99b6-c9f2011a03f3", "value": "T111C452682F16FCF259E46641993F588BCF36AA10DE15F3E4260386D032E6579B3E076C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271407, "uuid": "33e032f9-2f73-4743-9e0f-c56b83b25c8b", "value": "6144:n4Pj2uHDs7oUOKVJuXHXZyG+TmmcQLLijGoW:nA6ujs7oUG5rbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765271407, "uuid": "f2205095-d48a-48b9-829c-84d3e04824b2", "value": 583481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765271407, "uuid": "81973251-13cf-4fb0-a6c2-628d55d282ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271407, "uuid": "37b232a8-c838-404e-9d85-a30c74ce8255", "value": "ORDER-09466-251209AP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f3430e-d530-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765306457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306457, "uuid": "c9c75e2c-39d0-42df-9a0c-cd1aa9ea58bc", "comment": "Malware payload (Mirai)", "value": "78f20128850baf393050dc85875a0699", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306457, "uuid": "0876e5eb-e97f-4733-8c23-7669015ae068", "comment": "Malware payload (Mirai)", "value": "b353221db9ccb4b096bc05f25ceeb8718278dabad990b03092708828a4ea4ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306457, "uuid": "55a6e071-1c0f-4eb6-938c-ae078d09762e", "comment": "Malware payload (Mirai)", "value": "123960e0a761c99a2319543114dcbb654d7aff74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306457, "uuid": "6fd71ce8-23fe-4e5b-a326-eaa3bbd17dcb", "comment": "Malware payload (Mirai)", "value": "7ad9979c05010fbf6460299407221e58cb454b3e213bbc38eda35bee45e8aa936298d6dab09b3fd7f4af0decc1686778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306457, "uuid": "228a1c0b-7903-49b1-909d-e7e4876018da", "value": "T1FA244A80F587C4F6DC07857060A7FB3F9B3199AA8076C65DEF986F32DA27641422639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306457, "uuid": "71e2a877-fdf1-446d-8c5b-302e78791292", "value": "3072:b2KGn1XlANoOswRzMbXhM172Y1hmdTE6xWWMffeFCLNpa4WXS7dqcxJ:dG1XeNoOsG0xM1SYLm5zv273WXS7d7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765306457, "uuid": "8ad37faa-24af-4b49-a689-f7c0b0ecc096", "value": 224612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765306457, "uuid": "2cc3cbe5-61c4-449e-af4b-6fcb42eaa231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306457, "uuid": "47761c80-348e-4dfa-a834-d534f6e67a71", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a270a39f-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765248119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248119, "uuid": "f6b3e7c3-6428-464b-81b2-a971c7664e8e", "comment": "Malware payload (Gafgyt)", "value": "d18bcead7a4728ffe3d53187dd12207f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248119, "uuid": "4b61853e-8d76-4320-80b9-38b3cb9822c5", "comment": "Malware payload (Gafgyt)", "value": "b3af2b24fce06e94f7484946a35ee51944676105381934eb74681958ed0b03d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248119, "uuid": "ade64125-9de2-4c47-82fa-f0e09079ca2f", "comment": "Malware payload (Gafgyt)", "value": "ac502fae96c8d33c641ed91f368bb6d0780e6445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248119, "uuid": "e72fc5cc-b980-4c34-93cf-6aba51547b9f", "comment": "Malware payload (Gafgyt)", "value": "bc665d19c40bed95254d5be72c80e241715e3aa0ed7afc1b8e36ad8bca2b375d5480874c11c6d35d3f66779e4d51028f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248119, "uuid": "03539f59-8c23-4bb8-a4d3-c046a3f0b7b8", "value": "T106F3C9968A31D9B7C053E9323A756158B39CBB6A0B0F09CBBE1D75621E1E0CF641F364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248119, "uuid": "338cf031-403f-4c52-93c4-2ec78bb23d38", "value": "3072:Xn4Ngp0e9HGp1Ya9HF29FrhlLIQG9ZQLUD0afD+tKIj:X4Ngee9H+fHs9hLoZQLUD0afD+tKIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248119, "uuid": "34b67cd1-db62-484f-af83-ebb8b029e0b6", "value": 171633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248119, "uuid": "1ed43838-7f54-4f00-9ddb-b939f9f9ac1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248119, "uuid": "a82b9567-b251-43bc-a594-48eadd66dc84", "value": "Demon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bea56e-d552-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765321008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321008, "uuid": "dffaf719-cf41-4923-9993-ba2fae176064", "comment": "Malware payload (Mirai)", "value": "c90fa689c1839b0cdb12c096ed0790a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321008, "uuid": "62990c4a-ea2a-491c-928d-b29e7f65669a", "comment": "Malware payload (Mirai)", "value": "b55d8e48b3792d08b8a6e175d9cdeb1930f3f570334e2cb9215ed3bc5d027fce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321008, "uuid": "564113b7-36a7-41b9-92ac-6dde6824a403", "comment": "Malware payload (Mirai)", "value": "96a938bac9004392234bcb0fd52c7a76c6df8ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765321008, "uuid": "7ba12ab1-a9be-40b5-b053-9435bbc6c146", "comment": "Malware payload (Mirai)", "value": "fbab787796e91a2971789261d62984a41aaf765da30708ea2808e1e896f724b49e4fbc0d1825ccb7464c215f376c7b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321008, "uuid": "2c9555ac-265c-44b9-a61c-8734d0b56bb7", "value": "T18423F175E6ABDE92E210083AEE7D068662390BB9E0FFBD27134D5418CCC765132D1A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321008, "uuid": "a429c0c7-cf05-4719-8b13-790094581bf5", "value": "768:UKF2CqO7wfttqZRHvpSh/R5KjGorDJbdUaRa1LrxYy+iL3Y6Vzzfa5QcE4Us3Uo7:U9CqgwftuRPpSQjG0DZdUamrx333Y6N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765321008, "uuid": "07beb244-784f-4c9b-ae26-c3b63bd54cbf", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765321008, "uuid": "73d8a4fc-b4d4-43a3-b025-a399f72f4be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765321008, "uuid": "484b1f16-21fa-4ee6-b459-890ce7e9c2fa", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da7c485-d4ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765277531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277531, "uuid": "446cfb1f-4733-45b9-bb13-0377552a5e18", "comment": "Malware payload", "value": "e9414a2cb2346cfe9104684a1c1aff80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277531, "uuid": "25e82b09-498c-434e-8974-21e54c8fc107", "comment": "Malware payload", "value": "b6ac4aabaf969045958a977f35dc5b4f6646d8476a41471f7c7ee3819b5e6303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277531, "uuid": "e0d11f43-48ee-4967-9025-23a4a562748b", "comment": "Malware payload", "value": "f873a8eba785168d0e77feef52f12a46ad7993a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765277531, "uuid": "41934867-61ef-4411-bee8-b672795fa025", "comment": "Malware payload", "value": "a7c36f5517430427ee6d1621361368307261b6a2532dfbbe955002c13a8101abb6c3a85f835c4af5a42ab835bfd26984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277531, "uuid": "0c41f1ec-c6cd-478b-89aa-7dd989cd99cd", "value": "T184D623DBA5C521E5C8879E70678F23CE33E0B1515C66A6393FC72C029832EA79546B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277531, "uuid": "df90c8f9-4467-4061-955b-e131afe51b65", "value": "860714c41d4908a0b78d349f3d9a82a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277531, "uuid": "9fc8c981-61cb-4534-98e5-dec0e3072773", "value": "393216:zfNIEgETBd3x8XYJoH9ZpMqTYBV8az+gnbw/s:xlYXjdZp9GagbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765277531, "uuid": "cab14f1f-0aa9-4f0c-a3c8-2d37ca69f8dc", "value": 13363200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765277531, "uuid": "3053a20a-385b-4a78-b2ac-885189577dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765277531, "uuid": "9d2936ac-8605-4f20-8ef9-b7eaea49f5ab", "value": "renviox-inj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8ccbea-d543-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765314491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314491, "uuid": "bc8e7a7f-b5c0-4ec0-b9e4-4af54e958d27", "comment": "Malware payload", "value": "4efc683055558b0e4bf1bc82fca748be", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314491, "uuid": "fd09fe00-43fe-4867-a3e4-aed5a7e3d5a2", "comment": "Malware payload", "value": "b6e47ecfe626ffef28724472c26e47a44948939c1bc39d5007e7137854581f87", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314491, "uuid": "01ced3f9-fffd-4492-9a3d-a4fb4d0c0b04", "comment": "Malware payload", "value": "a0b16dcf229157f0979e90c3eef1f752747e6125", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314491, "uuid": "c4fc8456-0f0d-44c5-a3a3-e3ffe3f74107", "comment": "Malware payload", "value": "a49fde4c2da8cd1d58ca56f80b956a5926d7370495eaac78c0eb643ba34e8fe2a1c7984d08600d8071c75925be769243", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314491, "uuid": "3ae09141-3f47-43a1-b8a8-54d38572a6af", "value": "T19F25FE221FD29665E2770F318BFAF3624276F820DC1746AD9088D24818B1640F5BAF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314491, "uuid": "43ad860c-b626-48cb-8a6c-fbb883bec376", "value": "24:8TE9Jzxrwftd921qAgA4BJUFqrSAOF8mR+IMw2VcpNtkY41EFkaobVbUEcm:8I91o52zLg3rSAOFzRfMvfn13Bblc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765314491, "uuid": "e4aa95ba-bac4-42fc-b1c0-3d858a3a0f32", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765314491, "uuid": "ed812e16-bd42-4a8c-91cc-5512841d058e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314491, "uuid": "ab937a84-cc7a-4b52-95fd-2b6ffbb97e57", "value": "Scanned Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd46182-d519-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765296802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296802, "uuid": "288a44da-b577-4405-b998-0374fde26d8d", "comment": "Malware payload", "value": "2c7a4e42321be999bf402b3efb4ca31e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296802, "uuid": "1f1bf3a8-16c5-417b-b9b8-96850fe569b2", "comment": "Malware payload", "value": "b78c25e39b1cffa04b76119b0406e02943f108b0b65b67031c05047eea81f530", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296802, "uuid": "0b59ed60-913f-4f54-97af-eb701bc88630", "comment": "Malware payload", "value": "acbbd6e083fba9d0f4f327249ac0b415b6c40128", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296802, "uuid": "35e21b00-9bf3-4fef-9ad3-fb4e76e6e4ec", "comment": "Malware payload", "value": "d7796b8bd8ecbef1a731ccb640e52cfd7b357306d78f3e5b74156a4aabd69c48d99a131fac8525f5bb336bc0a8f724fd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296802, "uuid": "e4bfb7fb-075b-4a29-b7f5-536b503dc834", "value": "T17032298CAEA13170F21703DD3BBF65591229E0D7244CC994F74DAEE8AF4738D8246E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296802, "uuid": "01ee0a7e-e930-4b45-b2bb-13b30f260a8a", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzlqHtd9wDsIPQjAFjE:sXX+/DV7k/3lqHtd9wDsIoKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296802, "uuid": "a18836bc-3864-4177-8215-d52a356892af", "value": 11929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296802, "uuid": "5c5b6003-6a56-4010-9b79-33ce902cde06", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296802, "uuid": "153cda3c-1877-440e-9b0d-26d699885db2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b610f0-d550-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765320312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765320312, "uuid": "58a8f62a-85b1-4d5a-b201-8e2770f92f5c", "comment": "Malware payload (XWorm)", "value": "934519a23b703d07355c354b8f0ef991", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765320312, "uuid": "7927fb4b-db2f-4ddd-a2d6-a590e2989d2a", "comment": "Malware payload (XWorm)", "value": "b7b8016b837766fc9a8d6cfeec6239c05778eec6525bc61327b6311427c4a289", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765320312, "uuid": "ffdea7f0-b1db-4213-bf8a-0fae1e3ad1e7", "comment": "Malware payload (XWorm)", "value": "8a5f456d2e379a75c20ed74bb4651e21427195b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765320312, "uuid": "66ba4525-099b-477a-bcce-7378b58dbd36", "comment": "Malware payload (XWorm)", "value": "a07a2993d7620a2316ad238bcbf312df8eb0b3de3984db7ff042c22f30c102824ac373b18204a221a79927017f309350", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765320312, "uuid": "bbf61f4a-0b56-4c56-9d24-69eb26400003", "value": "T118061A44F484D7982C236D277766B0F242D2B65B7E47C633E01E86F2BFB31C2691265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765320312, "uuid": "ede05bc8-99ad-4e1b-9749-9d0e1d166bc8", "value": "98304:+60WbgA0+BfDjDtoMaUggQyRNpA6BFLjvVoglDegpQWkuSVq4kUkXudOWQPyvDx9:EWEAhoM5HQyvp5FLj9oglCg+hq4kbXuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765320312, "uuid": "b9263a98-c154-47ea-bf65-b36d7acedbef", "value": 4008692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765320312, "uuid": "690ce37f-79b6-4e51-8f3d-e407c1647d83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765320312, "uuid": "273c27c7-064e-458d-8df1-a197c351da02", "value": "Invoices-10000 20000.JS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6d273c-d529-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765303537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303537, "uuid": "4da9849e-8a91-404a-b02e-9742992e39ad", "comment": "Malware payload (PureLogsStealer)", "value": "e6df1b3bc02ae673d1fd01ac7abffd11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303537, "uuid": "6cf3c88d-0209-404e-a1ee-6eab3588ae2d", "comment": "Malware payload (PureLogsStealer)", "value": "b7f767683d6ba7f2a015deb244563b8ea8f3f690aac4dab8d7b12c7dfbd7bd51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303537, "uuid": "cb998ce0-88e0-4a2d-a7e2-fcff547117e3", "comment": "Malware payload (PureLogsStealer)", "value": "88536122b01a330844b15a2668e429c603d3bf32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303537, "uuid": "d02fe486-c8dc-4dce-a9a6-7cfd874aa1b1", "comment": "Malware payload (PureLogsStealer)", "value": "922832c4afb99b530b0a799199ac98ea4422e7f1eebd94a3e333b27fb99243addd8b08207097ece351010d8f82620d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303537, "uuid": "e30e50dc-6f6e-4ab3-a62c-192f4ca75997", "value": "T13945F1D03E69770AEEA00630A578EDB582E92D687420BBFA19DC3B4735FD6009D4CF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303537, "uuid": "cc5e0483-8b0d-4e2f-b3d8-6f17e18fd368", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303537, "uuid": "61125175-913b-4cd5-8b47-6a08fb2d4093", "value": "24576:PKdzrlN+PGqjAFK1Yv//rXi8jQsu+BflWngUJBadC:alEPV8w67XRQAlWnPJwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765303537, "uuid": "d066bb5c-8ce2-489d-a5e5-04ebbf6710df", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765303537, "uuid": "d570da44-fe91-4d28-aca6-e5d2f51e443b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303537, "uuid": "def4abd1-304f-47a2-b478-edce0d8cd3da", "value": "Order and Technical Specs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e431b09f-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298910, "uuid": "50518467-ec1a-4284-a099-09feae5815fa", "comment": "Malware payload", "value": "c96dfecf339c82365a21d359869da8c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298910, "uuid": "e81981ec-34d9-4e6a-a7df-07392e4d6e5b", "comment": "Malware payload", "value": "b87678e06f85889d226648aeb0c56fcfd82da9f97b204ed79b05b0db4c4931d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298910, "uuid": "fb8a1996-966c-4d75-a82d-7c28fba26606", "comment": "Malware payload", "value": "5373417a7f9b0d906f71bbd72f7129dfda46f971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298910, "uuid": "2432363e-1291-4e92-a6f6-2b318180e12b", "comment": "Malware payload", "value": "24556b84722d530bce8effce5a0e88e70d9ca7d522735e7cdb1c6a33a411ddfdbba0dfc482f9cba9ae8203b9c2a6ffca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298910, "uuid": "776c6fdc-d807-44f6-aeb3-df993579b54b", "value": "T14D137C628C794D55E91C6274B4304B768B4BC510A3CA6FF72916C1B98183ECCFA8E7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298910, "uuid": "70b86cb1-7d16-4afc-9c3d-692d57203e9a", "value": "768:c/3E+i6IUumFJ5lSiU3XeWV9jUjCNs5PSs1soGJBCYoT3bsRV:O3zi6JJ5lSi+VVVUjL5PSsRKBCYoT3b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298910, "uuid": "ce25f52a-d2bc-4c8d-8475-a54054bf2433", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298910, "uuid": "d614128e-c0c6-4c03-a150-a0ffbb6e5ab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298910, "uuid": "12b8a1a5-351a-4aa8-bb33-441134291da1", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565f8c87-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298242, "uuid": "8194a08e-473a-4a38-83b9-51ce7e5477e6", "comment": "Malware payload (Mirai)", "value": "265d61bf283370c23e8b5d3ad8d17ce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298242, "uuid": "b53839c4-9174-42af-9f31-36fb9b799543", "comment": "Malware payload (Mirai)", "value": "b8a839dd0e839c887d7101ca0389f7b7185cd82a4a4c294631afffc85c9bcdac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298242, "uuid": "f2b0d767-7231-45df-9246-2b22bbc809b9", "comment": "Malware payload (Mirai)", "value": "24fd5cbe4c4340b57c6f1d23a0e64e78aed3ef82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298242, "uuid": "f9c3f73f-fe28-443a-a0a2-4d15f71e6c08", "comment": "Malware payload (Mirai)", "value": "5692bfaebb2d11354dd4559c8304b14f282f85706f59a07db39fdbbe6ef000f1c1ac9d39d5831cd93dc7aff71ca6306f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298242, "uuid": "9ac3f41a-4c10-4900-9000-2a3d86148648", "value": "T173A32B03F99544FDD082C6344EAF90778A35F5AC13247A5F2784BF212E26E312B6E66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298242, "uuid": "7b2c9ca2-f9e4-43c3-a8af-79360fe6bc13", "value": "1536:n3OwEdC/J6UNX9Bg1nPmai6XONl0uaSHMYn4e9VWNQpnt53wdRcbDSMtoEQ1It35:n3v59Oevzlz5drK2zMZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298242, "uuid": "7f4ab2c5-7c6e-40e0-aabb-25382ccf39b8", "value": 106824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298242, "uuid": "f5fb2ae7-7505-4dd0-ba91-e2424b279f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298242, "uuid": "6d94602e-0587-4ca9-b1b3-968b956be95a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cabb946-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287918, "uuid": "3a9d8762-2455-4faf-a8d4-34732386728d", "comment": "Malware payload (Mirai)", "value": "23546aa7566f351e15de4f4438007563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287918, "uuid": "3237a2aa-844f-4535-91dd-89f4375a1ad6", "comment": "Malware payload (Mirai)", "value": "b8ccebf1a8bb7b0a4e94c80db21dfe1541d8237978e9b15f1a1b6bb4a34cd4be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287918, "uuid": "ed9c05b5-6057-47f8-aab5-16734d041bc3", "comment": "Malware payload (Mirai)", "value": "ec35ca7f27633504eb11a57b814725365b7b7b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287918, "uuid": "9c4fb7d0-8781-4fcd-8a39-9d07bda7aa2b", "comment": "Malware payload (Mirai)", "value": "538059347e9cc7d8fdb64b0805bdcc3bf4c64e92642691dbc782aac3ce1cf301b95ba03c5dc9638f37031b3a92da9f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287918, "uuid": "63273d4b-5cfd-48d0-90e5-7520670dc0a7", "value": "T18E53F94AFC818A16C5C413BAFA2E118E33136778D2DE73129E146F2477C696F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287918, "uuid": "bb98001a-be53-4a92-abea-2263c7543ac8", "value": "1536:0pn2hLNmBpvt9yA9iE+94fZrsapaczKxfRnVvEao3eL9IBiDemlZWk:lNmn14Iib94xrsNczKxRVHtemlZWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287918, "uuid": "3f633c6c-3e62-4515-97e8-b12e52a2a808", "value": 63184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287918, "uuid": "cfbbbc57-2138-4147-99b7-fb084db61e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287918, "uuid": "67319476-c93c-441a-b895-5ffafc5d3d31", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88c9808-d539-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765310406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765310406, "uuid": "2ace0ce7-ac73-4f9a-af48-dd507983d080", "comment": "Malware payload (RemcosRAT)", "value": "980664b6a2055913759ca4b735500e73", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765310406, "uuid": "5e7331c4-3675-4c2a-9ad0-074a4b86d900", "comment": "Malware payload (RemcosRAT)", "value": "b91c910b0dbfc5dc6c4392ed68034832f177d0cf394800d7d8054194878d9283", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765310406, "uuid": "64ef06a2-3320-43d5-b45d-4caf623e7128", "comment": "Malware payload (RemcosRAT)", "value": "d9d9c16854ff5a210aaef1cbb3e1100cea6573c5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765310406, "uuid": "b7cca669-cf09-4c00-a615-c3df70b50e0a", "comment": "Malware payload (RemcosRAT)", "value": "cfa3303a03694b044c408e16bb6f165213e5b5344dc8fe61947e9d7dfcb19a8451227cbd36d8f0ec9155c471e922331e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765310406, "uuid": "a148013f-9678-4ebb-900e-603778304bd8", "value": "T1C6C533CC09C71A01AF7511D736AF5E87CC052A5B4ADFA3AE3A2920FD87ECD96167054C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765310406, "uuid": "184d4995-da04-4e94-9a56-4597bbba3fe7", "value": "49152:xBawF3cm6y5Lx2fh2wkE5Q6Eq/kIMIl3aypLk2wU/fRtdMPGSZWT7:aIctct2fh2wkKNkj63aypI2ffZMO5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765310406, "uuid": "cdeca43e-fa4a-403a-87b6-419fd49f3524", "value": 2601480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765310406, "uuid": "5f04ea20-96b8-4eba-8ed8-90942b1ae7a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765310406, "uuid": "bc1e6870-6c3f-41a4-bc32-4d2d469acf15", "value": "ndzjopzpa.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304d55d6-d4a4-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765246209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246209, "uuid": "4572c833-087a-49c7-9181-e3e23b1e8deb", "comment": "Malware payload (PureLogsStealer)", "value": "999190bdbf9716143f68977747ec0824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246209, "uuid": "47ea0fbd-3d12-4156-9372-41fc675074c4", "comment": "Malware payload (PureLogsStealer)", "value": "bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246209, "uuid": "f234bed4-c1aa-4072-95d4-7c238e6bd551", "comment": "Malware payload (PureLogsStealer)", "value": "036d7322a3ca1cf24fabfb17e0676a3c8364f5cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765246209, "uuid": "3898ff10-29d2-4ac7-813c-38fa364cbafb", "comment": "Malware payload (PureLogsStealer)", "value": "aa3332fe2d175f0d670746eebbbec08b4377c0c8725f4571ff5203c385a193bc87ccf2e5f66595f0156d2a70e46a3a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246209, "uuid": "f9c8915c-d981-462c-b127-bf78423ab8c8", "value": "T19DD4CFE0FEEAE515D88586F7D81ECA1188203C0C27965C9273852B3D95F35CDEAE81F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246209, "uuid": "26e50bf2-ba33-4c76-a2ec-1f68bb58f6b4", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246209, "uuid": "f8833c5d-9e33-47e5-9ce1-8a412d5e8902", "value": "12288:J6L45thap5UwTk26UjwTbcl6IyyBx/13MRkHZ:J6cthapq6k3owTbOyyD13MR6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765246209, "uuid": "43946d3a-dd4e-4ad5-b3f6-f60ce6d2fd6a", "value": 628888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765246209, "uuid": "2fc1f325-a6ee-49a4-87f7-cb9e831f2ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765246209, "uuid": "4f7e0e33-9356-4384-8062-820e219d6041", "value": "FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c3ce9c-d4f0-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765278974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278974, "uuid": "5ee8b2cf-bcb4-41e1-a2bf-3096b3ded3e1", "comment": "Malware payload (VShell)", "value": "01c2f3b20cd2c245fd7b717176f76b3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278974, "uuid": "66346151-cbc3-47d7-a2f3-11845b48a5b5", "comment": "Malware payload (VShell)", "value": "bae364eb1473d616facdb82443d83af1bd832cd2bd29553ed1f4c44dfb1cf5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278974, "uuid": "464d3919-b3bd-43fa-a2a4-d9bb5a1bd501", "comment": "Malware payload (VShell)", "value": "908c00ee9793fbe3495a572a6000a2d10368b03c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278974, "uuid": "10f5105f-95d2-42ca-a8a5-d0247f98c52d", "comment": "Malware payload (VShell)", "value": "ee5e7e6a7a33d6942a09ae6492a9632c42d65beda89d606889e173f221a098fca8fdaeb4bee51155236ec2029db9625f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278974, "uuid": "365f5a88-5d37-43e3-ba23-4f6b4249651c", "value": "T1F3862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278974, "uuid": "b15a9544-432e-4309-b649-66066e405b2d", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXa:glRJXp8L/KyZcCb7tEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278974, "uuid": "2c3523bd-7140-47d5-b6a8-d00337f6d325", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278974, "uuid": "97396c59-2d60-49cf-b8d7-6cc5a17ae47a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278974, "uuid": "c870f33b-188a-449c-9f9b-2ee4b27482fb", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1037c4-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300560, "uuid": "b621a908-16f9-4a48-840b-d6defa145b65", "comment": "Malware payload (Mirai)", "value": "126a5bb4637f3b2fa812ed46f25c9adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300560, "uuid": "39339c54-1c12-484f-b7f7-2da4524ebcd6", "comment": "Malware payload (Mirai)", "value": "bb63108b584cabb39ad72fb5d79d80d325b5cfcd3e0511015129d1fb8fcaf29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300560, "uuid": "6345ed0a-8922-4cbd-ad12-912395cb7cd0", "comment": "Malware payload (Mirai)", "value": "25ef9748168a68aec924e17e4052191060fc903e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300560, "uuid": "53c5b268-5830-412a-8f18-3657c175537d", "comment": "Malware payload (Mirai)", "value": "96abfec27e4d1bbcfb3de3b37b1fad2937205093201e5c8ddb096f767e03db6f9d45f2e2e3ceb0fb5feb84afac3124d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300560, "uuid": "5db8c431-1a18-4085-8b30-aef1fa5e2e21", "value": "T12773F745FC819B11D5E922BEFA1E018D336757B8E3EFB212DD111B15738A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300560, "uuid": "263012a6-f625-4f8e-8f7a-4005fca701d7", "value": "1536:y2n/C+IoaGqiSnZdQoraYHaPfnjijV56CYdlMDi1LIssTT:r95qP+8aPfnjijV5JMLIxTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300560, "uuid": "6a7dd785-505a-4ac7-9018-46fa4d614b56", "value": 73548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300560, "uuid": "d43e0fbd-7460-4994-a1b6-a91e48e3dd3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300560, "uuid": "d66d7673-bb4d-42c9-81bb-1213c47a3a8b", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85075c0-d500-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286059, "uuid": "68662195-3b42-405d-917b-54e4caaccaf3", "comment": "Malware payload", "value": "9cfd9664f9ea0f556ed134520f48e14e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286059, "uuid": "1aa92d79-55f6-450c-992f-512285fb537d", "comment": "Malware payload", "value": "bb818ef6a7d21f94f33231bc076d149f07fc90bf38c93b7f4943b45a3036d901", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286059, "uuid": "f8868192-5d81-40bd-a539-d719067bdbc9", "comment": "Malware payload", "value": "db0c967bbabc373795a0b7c6b9d7361ba8b2bdea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286059, "uuid": "6b6ab83d-859a-45c6-af0a-2fd7b7d1ebf2", "comment": "Malware payload", "value": "1b95c2b7105b83ea6b4b4ed77920ea3ee8623cac1814e4cdd53b9d182fbf08832dea97dfb8e4ff08d21006e66166d833", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286059, "uuid": "e368f221-1b9f-4387-9fc1-70f5ef09c53c", "value": "T1A536E04C34C6E8CD6A623D75247B908AA2719261F447AED9F0DDECF20AF8564142BF3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286059, "uuid": "db10d122-0f58-4b62-9939-d53d4e484339", "value": "49152:sAiX2y3jO/H3FYkBQbjCG1dmbjmyGN0/KsiabrumMZW1MO85E7L7n1qVUIKf1D:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286059, "uuid": "4cf29dea-9c75-4009-98c7-c4862a5448b1", "value": 5161964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286059, "uuid": "0aad767f-fbe6-4b42-a3da-d31764467948", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286059, "uuid": "360566e9-d4f4-4a5b-9d7c-98caadf95286", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c03af-d4ef-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1765278667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278667, "uuid": "810b7c79-61f7-45fc-a870-2cc19d1d2974", "comment": "Malware payload (VShell)", "value": "dab92d7c3baa6fe71804319ba8c06af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278667, "uuid": "deb40540-2bb0-48d9-abe6-a0d1ca7a84ef", "comment": "Malware payload (VShell)", "value": "bba76eed1d4c13006e7ab47757ea400ff01134403c6bfd70d0d136e3ff5cabb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278667, "uuid": "0a9048f3-bd8c-4818-8b36-ac3f256d005d", "comment": "Malware payload (VShell)", "value": "db4167299db9888e02f877d801f3ca402a6a1a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278667, "uuid": "afee73a2-c392-42e6-b265-7d119533ac9b", "comment": "Malware payload (VShell)", "value": "0ee5e22e4c69ada2457a1231c48674ce481b3bff4111b920e973ab04508b3652aa2d44fca07d0af8a2b18f9db708a889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278667, "uuid": "622a2abb-0f57-4ad5-b395-dfdf6fe86aee", "value": "T15E863917ECA545F8C0AED1348A729663BA717C884B3027D73B50F7282F76BD0AA79714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278667, "uuid": "7a278af5-40fb-40fd-9b91-d1a06ba85d1b", "value": "98304:8+YepTx+m+kT807z6QM7ZPEmd7h4eCbY:5pTcmjT8oLAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278667, "uuid": "7c1f7000-c3de-4a4b-b987-84feb8b24036", "value": 8089600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278667, "uuid": "b3ffbade-95a5-4c36-a12d-89097d33c4f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278667, "uuid": "868c6962-84e5-4d95-ab35-cffde4169e4f", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45652944-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298214, "uuid": "405ade54-f70b-48fe-84f3-ce41b9fe9dda", "comment": "Malware payload", "value": "960f971ccdb6c41c616cb0f7425a613a", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298214, "uuid": "9b17e5f4-4b11-4ba7-a37b-263050139170", "comment": "Malware payload", "value": "bd440448c6aa85d80d0bb19a31817e1a816663b972177c3638b07714004dad60", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298214, "uuid": "a219aa3e-edcb-4542-b9c2-fc073d8bf431", "comment": "Malware payload", "value": "90d84f0ccc91e5a5c78c141df337d1e8176d8f17", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298214, "uuid": "642c553f-59a5-4521-afd9-07148756e0a4", "comment": "Malware payload", "value": "4fa1c2445ef4e7564d165f2445a42c039f89350beba7c996f46ce626e05f689151ba9a9c45f98a79e2abcac67041ddd3", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298214, "uuid": "fd472405-d6c5-447d-8df2-0b5a112e95b9", "value": "T127B5337339AE16EA8AE236F0CE37324E641408C6BC546D9D2C92F761841677BD94E4CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298214, "uuid": "b3cf1805-a245-499d-9737-4e0fc1e7c71a", "value": "49152:Yefx04rs3g9C3u5mElr9NAmNkt2LCKhifQeIr7V93J/VL46p5Ryn:dfi8sl3u5mEJ9NAmNm2eKh68J/1b0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298214, "uuid": "8372d823-dfa5-4fd7-96ae-ff5c3f14623e", "value": 2397724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298214, "uuid": "b392d909-b543-47ed-b009-0f82393d6db0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298214, "uuid": "cae606f6-42ca-41bc-a18f-0e123bca7a17", "value": "wiuyajsohiyq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec506e9-d51a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765297210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297210, "uuid": "f9d6ec14-a385-442b-9ea1-9e8a018705c9", "comment": "Malware payload", "value": "2a519bc4a6fbcb4411494ae365837a31", "object_relation": "md5", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297210, "uuid": "99d3e166-994b-49ab-a9ad-bf03ab66a63e", "comment": "Malware payload", "value": "bd79a967f2b525faf54ffeea94bf7abb9926209dc105dd1179231a02cee83f08", "object_relation": "sha256", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297210, "uuid": "c06680b5-8b29-475d-9d2d-e34099b41041", "comment": "Malware payload", "value": "66dc88f4975170572131602ef9b10fd23873573c", "object_relation": "sha1", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297210, "uuid": "9e7b4d9d-889e-4918-90cc-069dc4cf0de6", "comment": "Malware payload", "value": "e08dd321a15da39ca99580861dce117af48bafde8fc7c0a6826231a5d9fae7ab3c83a71964da7c1759d77abd06f34e08", "object_relation": "sha3-384", "Tag": [ { "name": "180.210.220.54", "colour": "#F2D7C9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297210, "uuid": "16697a00-cd11-4a3c-9ea6-be7bfbbce897", "value": "T11DC53373B39D28715BAB61AAFE4023B48D51A45FF9F504B8420B73BB0D729B8DB94311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297210, "uuid": "4e531018-fa76-429d-bd02-258264f01a58", "value": "49152:PsnI6PjgskXV9MmrYyu13umqFpwZROAFoW96g1Bnb1da8v5Xn97nmP:PsncNXIRyEUIblFfsg1J7a8R9CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765297210, "uuid": "997d5d2a-d764-4645-bcab-bb30a8baf8c7", "value": 2637660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765297210, "uuid": "a79d4ff6-bfc8-4592-9f62-fcd51efbc8d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297210, "uuid": "8b02f405-a538-47a3-9d52-35dcbb7a0dbd", "value": "vmtoolsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f81ffe1-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287923, "uuid": "1bf8b40e-57ea-46ff-85fe-106189296c69", "comment": "Malware payload (Mirai)", "value": "e289b3a6634f15d3e50275417a0079bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287923, "uuid": "e3d2e098-a8e7-4b31-afb3-1d65149fcd8a", "comment": "Malware payload (Mirai)", "value": "bdb2a340429242a515167156b091ee31de1398476c542695168caf17e640701c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287923, "uuid": "60f871b6-e331-428c-92dc-9872ffb1a5ec", "comment": "Malware payload (Mirai)", "value": "2906882b7b7fb58b1c029030ea2a011628295bb1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287923, "uuid": "dfe50902-8ce4-46eb-af2c-60abd22b978b", "comment": "Malware payload (Mirai)", "value": "f8c92aedc3c69dc3606d3fbe4488d9a4836f01be5c433363cace8e59dbcf79e4d9300b22380590d5d16a40ac7098c20d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287923, "uuid": "70124179-3a34-4eea-a6e3-1f527836f9c9", "value": "T121E0C254105735967E531E10B62ABBC13680AC55A610552EE3BAAE238CBCF017B0E971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287923, "uuid": "5121d470-2043-4cd3-8570-20399d6b455e", "value": "6:hdYUzfi0OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:XrzcOZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287923, "uuid": "489493e8-cc4a-4e03-8e3a-f22f2d2b1fee", "value": 331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287923, "uuid": "38986174-c1d9-4025-b344-c1ce6305048b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287923, "uuid": "3dba14e3-1c11-4d11-8bb9-e43fa6b35c11", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15870cf-d4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765285188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285188, "uuid": "9bc74566-2c9b-49c9-ad0c-507ad8d0d98a", "comment": "Malware payload (RemcosRAT)", "value": "d9f1efdfcaead8f263a9e9bd02d06517", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285188, "uuid": "737c64b2-6a84-4dd9-a971-976cc2496416", "comment": "Malware payload (RemcosRAT)", "value": "bdcec93d02727e058366197ec5eae9b2e887bbeb3f89c267ef545792a8d8d5b5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285188, "uuid": "789e013b-91df-4e98-ac08-4bd7831dc3f2", "comment": "Malware payload (RemcosRAT)", "value": "15a2f1a29b6b39ccc55549f75f83787f923e8b67", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285188, "uuid": "af6ad88b-f9d5-4c21-a4ed-384b7a6f601b", "comment": "Malware payload (RemcosRAT)", "value": "5a31a6accfdb16f8b9df6c5942c2398bf55c83d4f7cbde93da59d61637ba846ea4e009e7eecf63180283781a0482724f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285188, "uuid": "87bc217f-5af2-45a7-95f0-193fd6f0916f", "value": "T12995E1436F90BDAFC0226877681EFA9E0C1E3E6E7ED4950373DD6A09CB664412616DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285188, "uuid": "4e8f9d76-1acd-40b4-926d-92b4b8cfa2b6", "value": "49152:hJNQub7fSC8NESoCCJ+x//fXMbzRx+jDMxp/B:hkC7fuNEJdMkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285188, "uuid": "a4bd61f3-6283-4990-bf79-1ca7f086c25d", "value": 1950827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285188, "uuid": "ca32cebc-4d33-40f3-a5bc-50b02008dc7e", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285188, "uuid": "70c9c82b-276b-4c92-8393-182a19d446ab", "value": "MK2310-APRG-937-PROC-PO 1787-25-0O8320.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916d86bb-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252385, "uuid": "711779eb-f4fe-4839-8135-dfc7d24aac34", "comment": "Malware payload (Mirai)", "value": "546bdc8c051441ae8e50cba81aeefa03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252385, "uuid": "bcac7683-0b30-4c54-8dd7-58ebe9674284", "comment": "Malware payload (Mirai)", "value": "bf00aaa691623f783a1136b4a2c6aa34d99d10027a792fc43aa2f597a9875ef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252385, "uuid": "2bd52693-3b00-4ed6-915d-dd62d7e21dd5", "comment": "Malware payload (Mirai)", "value": "99a4a3c024946e21df9b21f0a9485f8e226b4337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252385, "uuid": "f79c524c-0fae-4f6a-b136-496fd36d4dfa", "comment": "Malware payload (Mirai)", "value": "e8304d4526c65dd0b7ecf1e807f6c88afaec74219ef4ad2a7ef9fe40b5ba922c51db040156c95b00f3642d527edee11b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252385, "uuid": "4fbb6a62-ba78-4a0d-9c91-4e3caa09ea2e", "value": "T15D045BA9BA0F2C42F1C6C3F8DE8C87E17A1735E3C67789B1791212ECDBA79D55980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252385, "uuid": "c385e030-001a-4055-8aaa-b51e917be110", "value": "3072:MAdN4BrXDd4q5JB3h0KnM7eNdhcGXOZMKZSJbxq:pNaXDWq5JB3o7eXbOZNSZxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252385, "uuid": "68dca101-bd61-4750-84fc-be072e2ff336", "value": 187400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252385, "uuid": "7f2c17e3-7d8b-4c92-8a7f-d57b88638379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252385, "uuid": "64b75edd-49d2-46c3-ac6b-f3aa4195bb7d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d1614a-d4b7-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765254612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254612, "uuid": "f4af0bc5-61b1-43af-8597-b89dc8804866", "comment": "Malware payload (PureLogsStealer)", "value": "423e12710b0977ba43e01a50e1bff21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254612, "uuid": "06e013a7-c350-4815-9a0a-1f4784ebab72", "comment": "Malware payload (PureLogsStealer)", "value": "bfae3fe9b5fa79f729d2eeeaf21bb0d8d5b1080c3cc08c8d36a4d90f27a26064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254612, "uuid": "d24916b5-476c-430b-b20e-de4d230be10b", "comment": "Malware payload (PureLogsStealer)", "value": "0ae217eb7a76dd7980090465faacdab89afd0d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765254612, "uuid": "76c671cd-3125-4217-91d2-926709066134", "comment": "Malware payload (PureLogsStealer)", "value": "1dbc64a87333d5ddf460a5dc4ef27888f5b52534e79b926e8681e36623f0ff0cac43b41380b3b97fa0075e1597cd04ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254612, "uuid": "7bf2ee11-a346-49b5-b9a2-bf8c15bbdbff", "value": "T1BED4E0E5FDD1F8AAC8A894F4C65F4B868550BC8D5B820D922349A72C08F710EDDDF1E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254612, "uuid": "713b45c8-1006-4bfb-a264-670aa87d61c2", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254612, "uuid": "78ea0701-520f-43f9-8f7e-c1e328a28d17", "value": "12288:oX6edX7wEDVllcHphQmw2ULxw413MRkBQ:oKedXMeSJSmw/Ly413MRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765254612, "uuid": "8cc79fa3-3c60-434d-81d1-ae0fd6425ef5", "value": 621320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765254612, "uuid": "bd2800a7-9430-4087-914a-488b8903b98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765254612, "uuid": "da8b5a59-9ceb-4a32-9feb-b2d5838b99f5", "value": "StySwift003-D4900-D03PP-W20000P-K84902-E38992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57741374-d52d-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1765305116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305116, "uuid": "31baa77c-99b5-49bb-a336-2957bb551b87", "comment": "Malware payload (ConnectWise)", "value": "aabfb01f11b3b58e3a44f059d929def2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305116, "uuid": "944f39cd-ad1d-4bc9-a1fd-b8ebd3946541", "comment": "Malware payload (ConnectWise)", "value": "c05720312e37c88164988cdb0bab4084c058a8cda4dec8fed917e7f9caf7cc08", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305116, "uuid": "62eb5320-b809-4cc9-b0f8-ffcd7ed29423", "comment": "Malware payload (ConnectWise)", "value": "071b4907ffac93a16d708c41acb2cd69ac6345a1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765305116, "uuid": "989f6c15-9204-4f37-90e9-8cfe9101313c", "comment": "Malware payload (ConnectWise)", "value": "64a57d630447fd06cd9e79788d8ee6070a01ae4e9ef490328a7184f91ac77221e8fe37b8490a574e7914119f338582b3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305116, "uuid": "55443e3f-2b17-4acb-9f99-2c9acc1fa683", "value": "T18AA6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305116, "uuid": "7d2c238a-8516-4d25-b476-eac39f6fd366", "value": "196608:WsuCcGaDp/mcYMDasuCcGaDpPsuCcGaDpasuCcGaDp:JuG/hMD9uGpuGquG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765305116, "uuid": "6943a0a9-7797-4fc8-bce8-30206c798969", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765305116, "uuid": "4117cf3b-e799-4544-861b-18b45b6f9f24", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765305116, "uuid": "b0c60565-4063-4770-8a44-b6a337f51e68", "value": "Payment_receipt_12_05_2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b802c270-d4ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765262758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262758, "uuid": "6c4accda-b5b8-4e94-8b70-8def98edd4f0", "comment": "Malware payload (Vidar)", "value": "c8e2e2c3cb26bb54dc5ffe15736faf04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262758, "uuid": "34f0805b-dd46-4462-ad97-9a8b22a0f6ed", "comment": "Malware payload (Vidar)", "value": "c15965c102cd686657aac51f08f360947af6ad2d87884e8fbe2f80ab58733235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262758, "uuid": "025fcf4c-2a65-4a12-8dc8-5ecdb8293f1f", "comment": "Malware payload (Vidar)", "value": "53279ec88f70f89665e1a54b2a473542c7e5a9b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262758, "uuid": "bbc9b255-77e6-409b-952f-42d6e7dae8e5", "comment": "Malware payload (Vidar)", "value": "0228f4a915651c6904a0399b07c862cdb662687af885f63bd1b9e22ca627b58519a7d551ab418844c5556b2f69947d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262758, "uuid": "f390cd40-9d6f-4d8a-84c0-70b74d9ddba2", "value": "T13A863A43B9853455C99FE1309C66A3917A31BD0B43313AD72FD866A60D2ABC4373EB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262758, "uuid": "194d1636-125b-47c6-89f4-b77da3fe8a21", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262758, "uuid": "4c5732dc-017e-4c73-90f2-b9a95f5af04c", "value": "49152:6+uQ3cY/OrxT/jgFMpuQCqNwulE9HGomDQJsBCGecozhElP0KSOA2j7s10PAXoYK:GQ3PUTcvN9VmDMsdXoEnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765262758, "uuid": "08f63ed1-999e-4af6-b631-12b4a375b38e", "value": 8426624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765262758, "uuid": "853123c7-4e81-4bfa-8568-32732cdebc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262758, "uuid": "13260886-7e16-4e2a-844d-605b182e9df7", "value": "c15965c102cd686657aac51f08f360947af6ad2d87884e8fbe2f80ab58733235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd6e04f-d536-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765308855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308855, "uuid": "e5c81485-9ac2-476f-a3c1-bafda23cc45e", "comment": "Malware payload (Mirai)", "value": "d1f91b391b6d517a66fbed0d11b2d9ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308855, "uuid": "539dbd94-942a-420e-9176-c780452d6d73", "comment": "Malware payload (Mirai)", "value": "c161d55ad04d87b9e5abb5b4bf18043215411b159a71c581cacefbf8b63246b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308855, "uuid": "2bbf1ec5-1a8f-49da-8686-1a3f2f17d7ef", "comment": "Malware payload (Mirai)", "value": "d603e6e80c54a0855c9fe20b6ecc01751d71c25b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765308855, "uuid": "fa5cafee-32f2-4231-8f87-f40ca245fe28", "comment": "Malware payload (Mirai)", "value": "c2a7c243a6989eff0cedbb19c14fb8a61f5d291a0ec291ef5912affc6db7342ff5187d8e1a2c69c9f3d437feb2af3ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308855, "uuid": "fff66ecd-cc82-4d25-97b5-649612ae4460", "value": "T171146C85F283E6F2D8560674605BEF321E72AA76603BCE82D3FCD636DC41641C51A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308855, "uuid": "f4b4f6e3-4618-4a5e-bde7-fb5bff658b80", "value": "6144:quAr5XydOYVR8Kb5/NZfLKbYE4zt3l2eCq2ZLoSS:qPr5XydOYV79KkEQUoSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765308855, "uuid": "7d27f3f3-4fcf-473e-b957-301c64b645c4", "value": 207684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765308855, "uuid": "af43ab0b-88a1-4a29-9d39-7cf048567f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765308855, "uuid": "6ed0cf77-8ecf-492c-aec5-5f38317e9126", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6a7e12-d4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765285212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285212, "uuid": "11d5a480-fdf9-4a14-8e62-eadff24d195b", "comment": "Malware payload (RemcosRAT)", "value": "10efbd55114d27bbb2b30fc82a697c69", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285212, "uuid": "32310a5e-7f23-4a15-856a-0c308cd626cc", "comment": "Malware payload (RemcosRAT)", "value": "c249cc8130366eee26cd0ed21a44df2a1c94d366ff6f65a98132977cf2338c6a", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285212, "uuid": "f5caa066-954e-44ac-a35b-c1327c0b61bf", "comment": "Malware payload (RemcosRAT)", "value": "d8b46ace7020066174c615e800263e8096baac2c", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285212, "uuid": "f91ccadb-60b9-4ad5-b102-d77445b6a870", "comment": "Malware payload (RemcosRAT)", "value": "4fcfd523b35f4d27599f4a199dc78dd4bec141e23670686687d15063118963c41804a936bbcd99ef3afe389791cb3179", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285212, "uuid": "64d0d416-1221-4bf9-9d4e-02d0397ffac6", "value": "T1D265E162B2E08836E163DEF58C15A3DA1429BFF13E75A84236DC3FDC87755792826063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285212, "uuid": "13ec0cd1-7fbe-4116-93db-e3411f1c27e5", "value": "24576:JXnH0PMb2lh3RNinBtrGEqv8nZBnFey12MkhyjFIXAbAzj8MU9buInKWXpdJgPTn:pnuukzWPFrey12MkJ3IFbvnKQJgPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285212, "uuid": "e7324ea8-d9cf-46e3-bb8b-6d348ace2746", "value": 1508867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285212, "uuid": "5a0eb253-5af7-4d70-bd37-30be71bb4763", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285212, "uuid": "b354e242-c516-408f-a458-ceff37e4538a", "value": "MaerskLine-ShippingDocument.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959a8bef-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252392, "uuid": "da536942-813b-447d-84b1-dfb8054781dc", "comment": "Malware payload (Mirai)", "value": "e4741238da07182ca5a447bc937b1e8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252392, "uuid": "b6280ff3-99a0-4531-907c-4eb95adc0139", "comment": "Malware payload (Mirai)", "value": "c3338b726fe8bd0675cb8da125902a734c09f00040b6d8f9de833a207ef4791f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252392, "uuid": "379cf542-b5af-4513-9d1a-69087ce452f1", "comment": "Malware payload (Mirai)", "value": "95dbab9b6830128b5730c4ce7ae1cdf40f4c4a6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252392, "uuid": "2d4eff77-8813-4a8f-a7ba-7eff84997c19", "comment": "Malware payload (Mirai)", "value": "f8faebf9c80a43642c2efa0639406753403c7887ffe724eae5346dcd203870bce748bc9fa8c3fad79d31f7d40a6bc2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252392, "uuid": "c12fb483-778f-4150-9d53-a6af991ce850", "value": "T10BE30845FC518F17C6C666BBFB4E428C772B0768D2EE72029D256F25378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252392, "uuid": "32a6dc87-3f94-4938-bd4f-838b8f94b006", "value": "3072:6iFTSLOjAqP2zPgbF/PXECP7oh0fwlKbD61Tdfk+Ogih9x:6iFTSLOjAqP2zP+3hPEh0fwYbDihfk+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252392, "uuid": "e97d098f-4656-4bcc-93a6-4d40f48c9c6c", "value": 146528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252392, "uuid": "21237432-2aaa-4561-87b8-375d1340c7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252392, "uuid": "7300dbb3-0d24-4e95-a340-4c2f80f5202e", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffce955-d53d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765312190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765312190, "uuid": "135e3867-c1bf-4eb2-86ee-1aa1c355b8ba", "comment": "Malware payload", "value": "c301c0379d5a602e4453c2376276a58e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765312190, "uuid": "53d55873-2b35-4b4d-9fc0-b1bc6b252528", "comment": "Malware payload", "value": "c34b5c5d3ca6e8ef51084329d45397a4533e736d7af5eb33d5845c689ab9c3f9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765312190, "uuid": "8d1602e0-9eef-4fd0-a76a-0a151e725fde", "comment": "Malware payload", "value": "11fe09477e19922b08bc633af4d4258b4f90ea35", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765312190, "uuid": "ab748599-9efd-4599-892e-641062ba9a04", "comment": "Malware payload", "value": "e688a48401257961b9820e7195661f2c517b6822552c6d43e7d07baa34c0ba910a7ceea22c681688e85293f674befe84", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765312190, "uuid": "d501341b-7f92-436b-bf63-017390de0a43", "value": "T154E49E2667A112FAE177C03ECA664A16F9F2BC590360D7C703E456A42F27BE45B3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765312190, "uuid": "e3d11040-250b-4e09-a28b-a777a455e489", "value": "358b82174bc0376c19cd6538ddb80253", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765312190, "uuid": "0f383c54-eaf3-4e9a-bf9f-0df55433aebc", "value": "12288:rX+o7328U+F92rz3yr1HieWsYmKfmqIM7vrS6:yG32dQ4rz3yrYehKfmmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765312190, "uuid": "a9308360-945c-4a9e-add6-241fe0bc9d4c", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765312190, "uuid": "bf7c8831-6ce3-4858-b916-8826c0479a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765312190, "uuid": "8806240a-ca5d-4210-babc-b45911eac315", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9003fb67-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252383, "uuid": "bc9efb01-c3dc-429b-9d86-75168db69f95", "comment": "Malware payload (Mirai)", "value": "ed6061649528192e2697754a18cd42fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252383, "uuid": "212e950a-363b-4377-936a-8ba35b4157f2", "comment": "Malware payload (Mirai)", "value": "c3dd8b63e749f4611cb23cd1c52ad6fa18a989d74d7a738b4acabcad547e74c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252383, "uuid": "cc9c15b8-563f-41ff-b7d0-7fb6f9246044", "comment": "Malware payload (Mirai)", "value": "aefad1c3b119faff7d18775b9f19a9b482b23132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252383, "uuid": "3fb2f0ef-b1c2-4648-8e03-e2e6da7fd54c", "comment": "Malware payload (Mirai)", "value": "991fa91fa89d5419e4b166556cc6c0834927da261c1b5d4e1d736ebdf7ae4125155363373e6e45414ef27f292ee059dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252383, "uuid": "9555c9e1-1a47-44e4-8eef-acbc4f16f679", "value": "T1FA835C8AF743E0B0D91505F0119BE77A4634EE725060CC7AEBC4FE76AD32912A51BB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252383, "uuid": "0e858260-4786-4f64-badb-ff44f3c986cf", "value": "1536:rglPYBK7XoDBrQmIVKMl2odYPq1zLUu31AsxTFHVCUOcr:rgt7XoDBrJUvdYQKg3CUO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252383, "uuid": "6258238c-3e2a-42b5-b5a4-1157a77e0543", "value": 88472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252383, "uuid": "0ce6560b-6a8f-47b7-9e42-9d5f6227c23b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252383, "uuid": "e94e9631-61e9-4c46-8a87-9622766e9ebe", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e9cb7e-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765286457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286457, "uuid": "fed31d21-f152-4be1-9191-6ecc1280d66d", "comment": "Malware payload (MassLogger)", "value": "941dde86f32c42ee70181f84a02aedd5", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286457, "uuid": "2911b64c-bc99-4e9f-a3e3-d2fee8ca0943", "comment": "Malware payload (MassLogger)", "value": "c3e888e94e0dde7ff77a0341b1205c1d06da057f88be12127558735c389f1b05", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286457, "uuid": "bff46ced-cc7a-47ff-a1e4-e2e3bce5028e", "comment": "Malware payload (MassLogger)", "value": "cb92a8102838649c7c84fb24587a7b47dc2668a4", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286457, "uuid": "87847450-0337-4990-ae2d-beb1775168bb", "comment": "Malware payload (MassLogger)", "value": "70ff6776f999335d433a08ab7d09fede96508dd14f86876d5ea288381cbffc350e595d5ba8a160794b920af8a9986a45", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286457, "uuid": "f9a92955-c9ff-41d4-a2cb-a62f7f4d9c23", "value": "T10455F35E4421ADD3A051FEB0F540EFA78CDB5784122747161FE5A8A96312C83FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286457, "uuid": "daa45827-19e5-4975-b45d-c43bb491ed33", "value": "24576:QsxRlqIKlX4DwzRc+gF9iKd8LOhOEOMA2JSDgxILpmqVqTHYz:jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286457, "uuid": "0ee22672-2e04-48a6-ada6-688117a65065", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286457, "uuid": "2fd12b6d-eb9b-4435-bf30-4035c3ce25db", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286457, "uuid": "46a1c502-6501-4f30-8a29-48f6eaedaf6e", "value": "rrck88943s.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7b076a-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765264594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264594, "uuid": "1ded1cd6-3bdf-4634-a720-2badb5a35b85", "comment": "Malware payload (DonutLoader)", "value": "5ba9a3edae59877d01c2caab24159545", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264594, "uuid": "01dae7e8-27fa-48de-bddb-579554fac904", "comment": "Malware payload (DonutLoader)", "value": "c43d0f6099f6e23d51d1488c016cb8337a52c0cb5a90e514d80717727ac9b6d8", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264594, "uuid": "86144d12-5cdf-49eb-a2e1-d473014ce1e6", "comment": "Malware payload (DonutLoader)", "value": "f9bcdaac9651a65c434743a77ded821a21411f78", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264594, "uuid": "27a62d0a-947d-4829-8790-3f95d3c92306", "comment": "Malware payload (DonutLoader)", "value": "8d63dfff6c07ce5aef5396ca283cabda99e71ee1cb780674277048cab20394277313916b45ad71e9b45bfa92f1fc3bae", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264594, "uuid": "f8dee5b4-d9f0-48f7-9243-0a4b371bd4d8", "value": "T14CB57C0BFCA118FAC0A9A23188725195BB61BC492F3123D72EA0B77C2F72BD05D75B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264594, "uuid": "5041b2a9-f883-47c0-a7f5-d24e03a3b9b7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264594, "uuid": "80f7a76b-78ed-4de4-aa73-817b9593a8ad", "value": "24576:tIJDlriaYbDMv0YY5NLB7IMUFTG6EhcVxHTnQ894x2zP1qGmcoeleTNj4HGu2+oB:tIJhrvYbYsYYTFUTdGmVRo7Ump", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264594, "uuid": "d63af277-f3ca-4b0c-a8ba-2bf300345552", "value": 2450432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264594, "uuid": "f332bcec-e048-4af8-84dd-aea25078c676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264594, "uuid": "e8b5f7f0-b0aa-42e2-9dd1-73439bd307e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fb781b-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252395, "uuid": "89d3a894-5a10-4866-8053-e4150c0ddfd5", "comment": "Malware payload (Mirai)", "value": "0c1423b3cf2ad701022a95a7ee6ee592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252395, "uuid": "aa3b79d9-41c9-4794-9551-c7fad9b6ffb7", "comment": "Malware payload (Mirai)", "value": "c488f3f8eb67fb5a8fda6c7ce9afb3358ac43eb2f8ba957e60b5c30b4a56f796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252395, "uuid": "483fe9dc-23b6-476a-b397-e09c17c41e3d", "comment": "Malware payload (Mirai)", "value": "1a54550fc78196dd54954beceffd296f1081516e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252395, "uuid": "3e801d4c-d2a6-4ebe-9f52-056b55b623ba", "comment": "Malware payload (Mirai)", "value": "79bceab7cc0807037c0e51f8248cdd843ff26340bedf485be6b94512ca44922231e52f9b05aa4aca107c0694896af9de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252395, "uuid": "c8f8b1f7-6878-4757-9702-0b46e98c99dd", "value": "T100D35B73C92A6E68C665D5B0B1708F792BA39561828B1FBE15B7C2748083DCDF6053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252395, "uuid": "366fa526-9eb2-48c1-ad25-60ab8a339607", "value": "3072:HBveST6uQFQ0dkgbfdom6cYetNW+o5wLiTo:hBDQykk6ym4+lLiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252395, "uuid": "c28f1ae8-3764-4c01-8c44-9f0ba44fa595", "value": 131684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252395, "uuid": "85688e95-3ee3-43bc-8515-96174cc30e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252395, "uuid": "d54c2f35-1fdc-4756-b7b9-a2003014c650", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d834327-d49a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765241990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241990, "uuid": "ab39fad6-3727-48c3-889e-e2e351509773", "comment": "Malware payload (Mirai)", "value": "0abc75cb06e5dcc52af11d0c318f90ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241990, "uuid": "e4dc3439-3e3a-43aa-a12f-11e2bf85ef7c", "comment": "Malware payload (Mirai)", "value": "c5052cb6873b1827bbca42721a888d5c60d75a9259036d6c301aeafe058db1cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241990, "uuid": "ebefcdf0-fa7d-41e5-b7df-b458f4a601e8", "comment": "Malware payload (Mirai)", "value": "b94424ff951d3e2c4e05d16a9d087b426bd41944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241990, "uuid": "3412e7cb-de6e-4302-ad90-6c440a2b1abb", "comment": "Malware payload (Mirai)", "value": "914a9a594087c3e63f079c7102180a03743c5d2a049a414ea059c078b138a7f79a02eaed41b25ed350a2f8ec99b159ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241990, "uuid": "0943f62b-d425-4fd2-8036-c741a799a541", "value": "T162638D76D578AC60C04889B576A8D9B44703A804A6F77EF1CAC29F59080BEFCF1497F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241990, "uuid": "ea79c375-a5de-4798-a597-7222ff66dd5f", "value": "1536:P/THhka1wt+nxjYraYEfNSmJemJjgjSYKLC0hy:PbH+Grx0rn+9emmjSYKLry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765241990, "uuid": "6f96830d-45d3-4d2c-a0b0-e0bd1bf1edda", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765241990, "uuid": "b0f2814a-189f-4acf-b64e-ea119828ab57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241990, "uuid": "1bdf8dc9-3a94-4340-b76b-ab0536dfb24c", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286ad1cd-d4f1-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765279267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279267, "uuid": "8f07af1b-ffd4-45ab-9ce2-7a5e2da171ca", "comment": "Malware payload (DonutLoader)", "value": "1230a6b01a64cf2b3d7d604715f97e16", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279267, "uuid": "a32f4381-24a5-4af0-9da9-6df11db5c7b1", "comment": "Malware payload (DonutLoader)", "value": "c52a7b20696067025fbe356c3cdc70b9d813a1969bbdf415df73456aa92d4097", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279267, "uuid": "7e4c4e11-a7f9-4384-b338-1c5a8bb06689", "comment": "Malware payload (DonutLoader)", "value": "5945f3262ab4c14b7c195cea6cef96d3ae96b05e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765279267, "uuid": "d0e8b375-e89b-45b7-b65d-0919ab9db058", "comment": "Malware payload (DonutLoader)", "value": "d0888e2832831e57c66fa75e0d7cb405ea9109e15d8a1249633fcb5055d3a368012c062e9e16a7a068c39d151feabfc9", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279267, "uuid": "fdd44989-e29e-4584-bff9-8edf408c5446", "value": "T1C65733388F9B06EDE8F7D53CD3219902B26439484B94CE9A47C0C7492DA35D9727EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279267, "uuid": "c44e1a5f-99c8-4ebf-9ea1-cf7f3ff22980", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279267, "uuid": "f59ea9bb-591e-4165-9a46-45111bddd897", "value": "786432:/1LGar/Q97OIXdwJkVJEwRWcV0GZ9qJJkw2:/9zdYG+JvR0GZ9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765279267, "uuid": "c605d8bd-67b0-4d10-8dae-ac3d55ffda73", "value": 28515620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765279267, "uuid": "9467ebcf-49be-4c31-aae6-54bd405ab37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765279267, "uuid": "267f63dd-3459-4b54-99c8-1b810f737f14", "value": "Overview of Project Salary and Commission.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e179e7-d52f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765306140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306140, "uuid": "21ac08a1-ebd3-47e3-aab9-2c4c570493da", "comment": "Malware payload", "value": "1ff13c23a518973448b9d7336e1087b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306140, "uuid": "9899efaf-d97c-40a9-9bac-097e89463446", "comment": "Malware payload", "value": "c671f48e7b84d3eb511c2ac09aa86492d2dbc52192889aeb455f6b193e197202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306140, "uuid": "7da75147-3f47-4f09-a75a-8e1b7efd0f0e", "comment": "Malware payload", "value": "43f70e0288d54d1980e8403bbdb97f40d3a5a48d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306140, "uuid": "b6b42f6c-d466-41f7-966c-6b3ed3841014", "comment": "Malware payload", "value": "b1f2f6c0fbaca241d1731d7085a484247ef85cf70dafb203e5eb1a882717cc27d3af62f4dac4c8eb6ca4e505fee38ea6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306140, "uuid": "681b4c27-a308-4339-8ad8-27004c104fba", "value": "T1AF73B6097B644FF7DC5FCC3B46B99B04288C960A26A43B757D30D818F65B24F5AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306140, "uuid": "f7723ec7-9d4c-4918-9daa-c5269528519d", "value": "1536:4N5ZMcGeqW301AdrRfTbWsRs3DeJTtC77H5A1/SjT3bsR:4bJGeqmNHgzjT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765306140, "uuid": "2bc45735-b936-4d1c-877e-3890e92f1fd8", "value": 80180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765306140, "uuid": "738bbd36-416a-4ed7-8c5c-8ea611404493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306140, "uuid": "0368e769-fab4-410d-9082-184b4783f615", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66595759-d515-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765294833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294833, "uuid": "2fda46c9-6dd2-4945-b8b4-26e02a145fc6", "comment": "Malware payload (Mirai)", "value": "80dd3a8419d1a3374254f995e5cbb031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294833, "uuid": "8940e3f0-547a-4fa0-909d-71c076faca87", "comment": "Malware payload (Mirai)", "value": "c819cd3e58864a49bd657b76cf4d8959b82e39ce99acd9e2cfd4658172aa5d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294833, "uuid": "1791cb27-c470-4445-a3cc-36fb80f21749", "comment": "Malware payload (Mirai)", "value": "4e6c54a3a55866cccdfe511702551f4ad713aee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765294833, "uuid": "9a008039-afbd-42ec-8e57-5b083b595a8f", "comment": "Malware payload (Mirai)", "value": "b4f7d66cb7d3e96610fb50bd244cd58ab1fa8d83d5c17685bcee5679d30f9d706f78a1fb06bcbc9309d37e44d9a199da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294833, "uuid": "2a9e779a-487b-4e1a-8732-9b908223182c", "value": "T122C3F659F8819B21D5D621BEFA4F529D33231BACE3EE7213DD145B2437CA91B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294833, "uuid": "6aaa16f7-44bb-4a00-86e1-76bbaf130fcf", "value": "3072:Dy+qbtt4rTC1mz6t25cE4huSdHIvBgr0mDarF5SIP9ghNitSzlweZn5Q:m+qbtt4rTC1mzo25l4hJopgwcarF5SIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765294833, "uuid": "b1b5a236-e5ed-47bf-92c9-acbfec8ab97d", "value": 128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765294833, "uuid": "963a869b-0498-4436-a35f-e42086ad12ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765294833, "uuid": "8f17d372-909b-4ca8-a48c-54460d314fe4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc75c05-d528-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765303137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303137, "uuid": "9cea7425-9e3d-4283-bbe7-1b00e9118c29", "comment": "Malware payload", "value": "488d98722346f8cd8191be0611f0b12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303137, "uuid": "3305f6fd-eb73-4c58-acb9-1d2a2fc76508", "comment": "Malware payload", "value": "cbe31dfe86ab712e2ad7bac0d2414087e43f246f4f5f97211e2fd587d7624760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303137, "uuid": "15813293-dfa7-4d9f-8f19-cc48ed56f189", "comment": "Malware payload", "value": "179407fa8550bbdbe36fa9fd7a4d608c5e5ba9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765303137, "uuid": "1eaefc6c-c140-48a1-b5f0-5d6a0a71005d", "comment": "Malware payload", "value": "15cd8ca1572cab0ae826c3e99e0e0ae32328f2cd2eb800a74e16cdf6b863df9921bd6a3b287013ea67216c2ab2f47ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303137, "uuid": "d8ad406a-1d44-468f-8910-a7b1ee489bae", "value": "T1745533D750AF51B7FFB791501E0F0527AA8BE9241FD05AB86850C2903AF4B1213E97BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303137, "uuid": "42477728-c6a4-448f-9cb4-ba03633d4662", "value": "24576:dLk4PTA0WTtByWS7tCNcU478vK/1E9FvbeZ/qEvcU2FUKE8CNI4RxEnwZy661/3l:dLk4TA7RByWSV4C/sqEU2Yq4fEmy6K/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765303137, "uuid": "2d4bfe7f-a7bc-4890-a8df-cc936c4b3b9e", "value": 1385736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765303137, "uuid": "1b88d7eb-c14b-44a5-a6c1-e508b4300c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765303137, "uuid": "b5c468a6-5bde-4d04-8ffa-d3cfb7e1a099", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a607725-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1765264426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264426, "uuid": "9851950f-0823-4cf8-874c-8500edce98c7", "comment": "Malware payload (AdaptixC2)", "value": "5809db8de0b6d21ed5f76fe8599016d0", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264426, "uuid": "f25abd0a-e7c5-46a6-8dea-b0282621f335", "comment": "Malware payload (AdaptixC2)", "value": "cc59222114d66968d342258240c9cd56b4182ea432952073359fec07c7cc4853", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264426, "uuid": "fbcfeb32-08a1-4e9c-a2b6-84dfc71ac5c6", "comment": "Malware payload (AdaptixC2)", "value": "b6fded1c864e47ba1c0d521d20a8c6897ed6a008", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264426, "uuid": "f135ff5e-69e3-47b0-bafb-a42d14a33156", "comment": "Malware payload (AdaptixC2)", "value": "b38e27e743db3ecb458012babe1e0506b227bcb945c8445a9f4f0383ab74b4b48349e948ab9f480d1156c8f927ab5b87", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264426, "uuid": "8d7d7eca-91df-4452-b08c-aa56ab01a1de", "value": "T118835336E6B3C4ADC05FD634AB8394B3B9F1BC5C4634651947C1A6223B5FD386BAE180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264426, "uuid": "dce6f59d-0fba-45d1-926c-e4fc3ffce183", "value": "c86a15ad8daa9fda8a1aa35746d80e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264426, "uuid": "f524cef7-f9a1-4984-b46e-ccb96a9107e6", "value": "1536:kmjklNrqI1q3y2z79tGRh++TVSi6nYVa58po0e2/T20yZF+E+a:lj2K/+b81KSdZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264426, "uuid": "6e753235-e98b-40f4-ad7a-0aadf93e28c4", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264426, "uuid": "2b90e349-d7f2-40f5-a9b8-eb85f698d2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264426, "uuid": "16b26b6b-c1c1-4f7d-aeff-47a956d6c030", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c1cf6b-d4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765269114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765269114, "uuid": "69a468f9-9e15-4e86-87de-0d38cc61f444", "comment": "Malware payload (NetSupport)", "value": "e1ab14fe909ab9b0daa918948e4d989d", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765269114, "uuid": "a2ba793a-8a4b-4696-92b7-191fd6ae3a93", "comment": "Malware payload (NetSupport)", "value": "cc665bedd44fe5deb471788330d9321dfa4ea5018945361d2f69e4d49316f27c", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765269114, "uuid": "987826f7-2860-4a82-aaa3-eaea744e9ced", "comment": "Malware payload (NetSupport)", "value": "c7b3522ea1e0b076aa4bb4ba0c3c67c0fe08757c", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765269114, "uuid": "6a4ecc8c-844d-410d-85da-7b47b4edacf8", "comment": "Malware payload (NetSupport)", "value": "4751199b4669b30a9158af892badb20aaa1db0d92d554b054e669a873efbfb133673677f315a844cdf00c988a3142bfc", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "growthcatalystes-com", "colour": "#2F30BA", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "operationalexcellenceus-com", "colour": "#D84637", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765269114, "uuid": "cc843cdf-832c-41c1-ac1a-30d2f93f6eff", "value": "T1A3A2D130AB7CE266EB1D49F3B2D6788C4FFC50585681438AE98CFD050A4FE9F1116169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765269114, "uuid": "4b9c6dfc-ca9d-496f-b820-eadc448d452b", "value": "384:DXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5Nvf:DXKuqXS69Szi/urdMt5lBUeuhJrsRxLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765269114, "uuid": "f4f21320-5da2-4ac7-881a-4d58b38bdcff", "value": 22226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765269114, "uuid": "0693c01a-f3ce-4ea1-82c4-5c5064940c43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765269114, "uuid": "dc466547-df8e-4bb8-99f0-ddb4c1005526", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8e3e25-d4bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765256461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765256461, "uuid": "a3fc5fc7-dd7f-4b08-9f73-22e3b300448b", "comment": "Malware payload", "value": "53962c253858e7dbf9f0be945a4a2088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765256461, "uuid": "ef202956-30cb-4342-bb58-3544fab10c4c", "comment": "Malware payload", "value": "cdae610869721ffefba0bf2ec385962830c90354870f5a82adce113cca11b007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765256461, "uuid": "d4aff960-0d99-494e-8b10-dc3bb03c3482", "comment": "Malware payload", "value": "b14e4629d9eb4efad12e90ce43a50aa2d6949656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765256461, "uuid": "adeff10a-5d83-48e2-9d4b-0f68c16df421", "comment": "Malware payload", "value": "b2967be77f7e7e1762d581bc30ccf83c300c5989e11ba98e1371e51b0fc59584f0af96b686aa7f574a2c11cf1d9eddaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765256461, "uuid": "938ce9b5-53c1-4f70-a5af-68e8eabfb71c", "value": "T1F1A7238324D5A2E4C0E74608538F51CE11E1B8EAD9FE761D2BC68C03DA71EA61D4EF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765256461, "uuid": "ca950670-14b5-4cac-ad20-f94b1089f182", "value": "a7eb17589a3047d7ff592bfab8dcb98d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765256461, "uuid": "9de17e13-e835-4258-a8a8-bf62c72fb586", "value": "786432:9KS9stDFcHTK1zSMA0k9IpLDPsY0VmyfKHHoUZ2PbeQUSJmXH0:9KSsf+TK8MKORbdJoUeyQUgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765256461, "uuid": "d9d4b3eb-5234-4669-bc88-02a03fed37c0", "value": 47483392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765256461, "uuid": "6517a3f1-682f-4691-afb2-cb9988635867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765256461, "uuid": "50353eef-23b9-43d4-89a2-c8d849b9b5c7", "value": "Unbranded 1.0.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8fb406-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765264408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264408, "uuid": "6388a6d1-c009-413b-95c1-454b9ee8598d", "comment": "Malware payload", "value": "83648f9fd498b655313101527b52f693", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264408, "uuid": "04057af2-834e-423e-a0a9-147fabd2d682", "comment": "Malware payload", "value": "ce4e2002297c59586b007707c75beadb9c822fd0ed4ae1623bf5d714cdb2e305", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264408, "uuid": "555f5ea3-69ae-4505-ae73-98128af5020c", "comment": "Malware payload", "value": "c7f89173dc0f2d89698be03f51fdc139506cc5b5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264408, "uuid": "8b7c367d-31d3-49bf-afa6-49e518665998", "comment": "Malware payload", "value": "1d5c71fe9729cbc9945faa0db45acc11434c96b4abd4440e89fa17e62a642278eced84614e965bf94b7cdb05d5a50e38", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264408, "uuid": "3cdd1c82-0d99-409f-b8aa-1c41b69eecff", "value": "T17047339EF3A82B2EC87315324E6A067522974F12E643971B651C752C2877ED80F13BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264408, "uuid": "65a647ed-33eb-4a80-ae41-df4a14c11d29", "value": "786432:UhpCo2DdWMN2AgWZc/3RDoSWDacpQqj3F5NF4c:YpAZB2AG6SOacpQqLF5rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264408, "uuid": "2900bdbc-6566-4c43-a7c7-ca0d1497d9a9", "value": 26412689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264408, "uuid": "73f720e2-ee76-45c0-9a4a-5c025ce109e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264408, "uuid": "f36d1fae-8632-4014-8e5c-78e706a89ca3", "value": "hjcsg4389-20251107-v0-3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d4ca35-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286216, "uuid": "806700e0-ffb7-4360-a7fe-df8988f573e1", "comment": "Malware payload", "value": "c25556f278e5a8e2e84508fc891b8eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286216, "uuid": "72af726a-249e-4fca-ae67-4a50a97cc0a1", "comment": "Malware payload", "value": "cfbb60670d3677184c446c5bf01c1ad95413e29d53317c8711dbb4741d2b2da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286216, "uuid": "562183c3-6b1c-4a18-9610-f10e88cee90b", "comment": "Malware payload", "value": "f8dee531b058a0ce463fdac97611b692cfeb38d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286216, "uuid": "b410f1c2-1395-41b7-ac39-085e05c2ef12", "comment": "Malware payload", "value": "e69e73f59c8b6e05f39f5175df3bd76a402f01039bed1019d646f45ac5b91685cad936354f9eaee42e01e5cb9bfc0fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286216, "uuid": "0510b4b4-664f-4d6e-8f4c-29746e56198f", "value": "T19296DF93B2CA687FC0261639486B9F94983FF63125168C575BF81C8CDF35190393AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286216, "uuid": "04d24224-31c6-4815-b12f-0744dfd927c1", "value": "1953cdc0967ae1abfbff6f9a094a0a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286216, "uuid": "9c2ab724-894c-4503-8fbb-576fc6a94cf5", "value": "98304:1hLgTN+uI4LmrB//xuJ8f2Sv50byaHYGy9olzWTH8y03VkitWgG72pxtSJ8:Dgs7VrBHU8f5REZ4v9olKTH8plvd/XM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286216, "uuid": "27e73767-8d0c-43e7-b9f8-ee4746b85079", "value": 8963016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286216, "uuid": "2c8aff9b-e5c8-44e8-a2b9-3e5b7f769e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286216, "uuid": "8bd1711f-4262-4380-b7b6-4a394bcef6fb", "value": "Robot Phone AI Media Strategy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19936590-d4f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765280960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280960, "uuid": "53142a77-1e3c-4b6c-a5f4-e96cefc8940d", "comment": "Malware payload (Formbook)", "value": "ee6aab15ac1fab53ea38583ef3742b8b", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280960, "uuid": "56b8d969-78de-4329-b576-34e1498228bc", "comment": "Malware payload (Formbook)", "value": "d00544cef451b7c386bf2b5ffa29b9735e4818cabf5e94d087e14fb3e4f8b75f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280960, "uuid": "97a15417-1df4-4f32-8ca5-7be673538675", "comment": "Malware payload (Formbook)", "value": "25b6df247e65b827e32a6383f87837c266bf7c06", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765280960, "uuid": "ac74b959-401a-48be-a3cc-ab1f0ba017d6", "comment": "Malware payload (Formbook)", "value": "9dc7b3fcc155611096baf1ccc60d07a8d3dbd8783647a5a67b4bbc1cecb51ebb4876b83c19f943472cef9943611f20a7", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280960, "uuid": "9125ab74-b687-4538-9213-97cd0ed9ea1c", "value": "T1192522B722DC3C3DD49D26FB7A4B307679646D8656B4388810173BDD1C98A9E260A0FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280960, "uuid": "a361a2d8-5a26-43b8-890e-392e9e294009", "value": "24576:X2gdrFt1ro4NshtRjEZuPIaSV9VWikwzM6ez5:PxtdNQt1EZuPIaSVjWiHzM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765280960, "uuid": "96dafac1-1de8-409d-bfb1-7fee60f13742", "value": 1007494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765280960, "uuid": "57f3d82b-5d3a-4a4f-ad08-5edaaf451911", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765280960, "uuid": "e67b8e31-f2a5-4ed1-a0ab-e95cd4db1943", "value": "RFQ- PR Ref 34838 ITR6967.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c89bb0-d50f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765292128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292128, "uuid": "4bb0a10c-fc79-48e0-b61b-eb29913bc862", "comment": "Malware payload", "value": "ad3f250381a989386a1e510321ec44ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292128, "uuid": "fa5bf295-3ec0-40e9-9137-72649fe40b4c", "comment": "Malware payload", "value": "d0459a84ffc9b6f7eeb627e90b1879e8d1e477baff9db93dde2568c6100b6b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292128, "uuid": "5b332b1e-8904-49a9-a34c-43df6438c3f0", "comment": "Malware payload", "value": "a4fe802a0c78311b462663b71b294d43e7beeb17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765292128, "uuid": "ebd51424-23a4-49e3-88c3-2244a7fb62a7", "comment": "Malware payload", "value": "d0795016abffedc8369518a8d0d1358c7b8e3fe652ecfa31a5ff27fb17b3af0f03c1241cbaccac379f8775822422aec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292128, "uuid": "e45387c5-f418-45e9-9d9e-1532e00c87af", "value": "T12984E117B3E111F9E073813889A60A15FB76B85507519FEF03A44739AF27AD0AD3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292128, "uuid": "59124f33-c41a-4d18-9f9c-c7f4518f5eeb", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292128, "uuid": "7c5d6d93-b59a-4462-ba14-de9fbc37e2e0", "value": "12288:vKF6aBAuSXwatGFWHAouV8SH967yzZXhW:ycGWHAouVnHH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765292128, "uuid": "9c3ecc3d-7a9f-496c-b719-e86b7acda204", "value": 407333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765292128, "uuid": "387acfb7-d363-427d-af8b-d9091efbeb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765292128, "uuid": "e8a32789-8c46-4d46-8e87-44873800e3e4", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2c55b2-d541-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765313687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313687, "uuid": "8fd49c4d-b544-4128-806e-146e8d587740", "comment": "Malware payload (Mirai)", "value": "f2eb81f1014bf15b51101c9d078d16fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313687, "uuid": "23ca7b03-fb2e-4c9e-a658-923d75bbdc60", "comment": "Malware payload (Mirai)", "value": "d05249f225051cce1245f2197bbda2af25b350858a8d5d40bd1571914f5fc862", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313687, "uuid": "5a6a95fa-e9b9-4f2b-bbe8-d2345fd547ca", "comment": "Malware payload (Mirai)", "value": "a1ca9b0270dd4becdb8099e2ac412faf7d467788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313687, "uuid": "5844d635-fc72-4df1-b377-5254e813c77d", "comment": "Malware payload (Mirai)", "value": "61867fdaadd6894bdae412c4954a757edadf70ce9b64adf85f0b8dbfd2efbaefc922b8b7ce1ccab53b131d6ea445ce8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313687, "uuid": "ed354dde-c72c-4502-9f8b-5961128ab478", "value": "T1C224AE76D8666DA8C1289174B1F1EF3617639044409B6FFAA6F3CB788087E89F0197F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313687, "uuid": "a009d8ee-9eb7-405c-af44-93d6065db1f1", "value": "3072:ODb1dixIDwDK1BIVHQaJX1euE7MNM+NNEliJj9aFnYnWqHAQjUEOP:ODpN+K1BIVHQadBaeM+DEliLjWqDjuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765313687, "uuid": "de141eb4-0425-41a1-b102-879d76e9b434", "value": 225056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765313687, "uuid": "c478ea68-4904-4ef9-bcdc-46a08b42c709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313687, "uuid": "8c7bc544-5b7d-4226-80f6-d3813ed84f9a", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ce8bdd-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298243, "uuid": "4d8a30b5-b556-4a13-b992-6f605ed8d9e3", "comment": "Malware payload", "value": "818c3bc6a64060ec4458c2fc6b79a322", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298243, "uuid": "94974c21-a7ff-4716-a076-274d030b5a0b", "comment": "Malware payload", "value": "d0c5a9d05ef2c84d44d026a4e6081fa19522c27773b4c263f657cb6015d30fe3", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298243, "uuid": "c0f6504f-4fab-433f-b4fe-2c4909a909d2", "comment": "Malware payload", "value": "f5d6abbb80deccb6998eb131c76ca107ba8e969d", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298243, "uuid": "10645abc-443c-4193-a783-f89f7206843c", "comment": "Malware payload", "value": "73e8baed39b673ec2c45af9ddb1ad407138736971fb5c22115a567fcc1ea7c568fd02195e08ea39b0fbe55a51f96850f", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298243, "uuid": "7e313e21-db37-4fe7-b709-9912f07ac881", "value": "T14D962A41B995892AC65BF234AD706210B7317D0943312AD7AFEB0A750CFABC4673FB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298243, "uuid": "961cf50b-d79d-45ce-9fad-072896d34603", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298243, "uuid": "d92629d2-dfca-49f8-84a9-23b856f4de96", "value": "49152:Ba5R3/SPsAWyA13AM28zd2oSQCXmgf5puxWZRldgygfjT/GX:u3k+yS5PfmuxWZS1fjTGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298243, "uuid": "27b50155-48ed-4170-8080-2667bbfa83a3", "value": 9214320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298243, "uuid": "c58c0815-e384-4a0b-9073-66092d33cad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298243, "uuid": "79456449-7a0f-42b2-861b-7e3fbb509e70", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c114ca5c-d520-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765299710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299710, "uuid": "920f48fc-1e5f-4fff-a989-9d3fa9e27ce1", "comment": "Malware payload", "value": "e6fac5fb682c2aeeb2fcb402f66fa32a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299710, "uuid": "9c469e0c-404d-4d33-bfe8-b3a02984e6d4", "comment": "Malware payload", "value": "d0ed83b79de04a29ff162ba115ac5db633d72c8e54ce3e9b2ada9c265e31b02e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299710, "uuid": "bb945522-2bcf-4948-8962-20cde953dfb6", "comment": "Malware payload", "value": "f48bce6ed35810bfef1598ed131d2d2da5176ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299710, "uuid": "8189c555-bcbe-4a05-a7b6-3532ec3f5ab1", "comment": "Malware payload", "value": "c23095498eb44b7bf0cbf0084b1879e580bb1864f99efe164e5a6eef9b67db4b46be918302ff4653b9f305ae633e23e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299710, "uuid": "f249d89f-fffd-49ec-bd53-2871bd4c9046", "value": "T174333BC4E907E8F5DC160A7855B3F7325A75F43A1128FB93E795E532B846B02B90A2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299710, "uuid": "6afd9d82-cdb8-4b94-921d-13d9b19c1343", "value": "1536:W1gEAFWo/o36u+UmE+iDzpmKJUcGVuRhWicuKITKQR:W1JEWo/869G+i0oUcGYr/nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299710, "uuid": "fb62247f-8426-452a-aa47-f490d02800fe", "value": 54740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299710, "uuid": "edd11469-8a44-4768-b0eb-ba9a7d8b2cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299710, "uuid": "c9b91060-dd19-4424-a647-6de705c6e7a4", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1367ee04-d4a9-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765248308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248308, "uuid": "a4d069e6-f943-4663-9ada-2ff9762ea85a", "comment": "Malware payload (XWorm)", "value": "a80e4f4d318805db0a195e43b3d8c2da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248308, "uuid": "522fc2bb-9dbd-4316-a814-19d708824596", "comment": "Malware payload (XWorm)", "value": "d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248308, "uuid": "1b33433c-5756-48d3-9bbe-806ec0040c56", "comment": "Malware payload (XWorm)", "value": "40b9c76cc9434fce19022a867bd566697a789d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248308, "uuid": "99abd68b-ad3a-4937-9756-29e932dbc107", "comment": "Malware payload (XWorm)", "value": "258e6f15941b06387c34cc1c73c018e2fa8f6f4f98f77be2cec91e654905f473cc084200f9ce95412767e1b00709be84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248308, "uuid": "60eed53e-c1b2-42f2-81ae-f1382df66c09", "value": "T1E8A4BED43A21732ECDA28931D968ECB491E42C797206BAE354DF3B5B794C151DE0CFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248308, "uuid": "442b7ff9-dd3f-42e3-a74f-6efee0a042ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248308, "uuid": "77552de8-9142-4ed9-95f5-d48c6ba4eeb8", "value": "12288:Mpu0rlYENKMi5uUUsF0mAYic3EWp0ehbbD+dJS:ErlYKtouUipYtnbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248308, "uuid": "dfbaa03c-a414-4979-9435-341f12d8776a", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248308, "uuid": "866fc7b8-393b-4f08-959b-33f194f52293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248308, "uuid": "1a4040a2-9e92-447e-b28a-4bb874edff34", "value": "PO-LDSS26LK503.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfa8e41-d4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765272512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272512, "uuid": "fffca334-d010-47dd-995f-65d8e432fd6a", "comment": "Malware payload (AgentTesla)", "value": "7c588980fad5b033a2da3da80ec9a02c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272512, "uuid": "dd617ef2-6f94-4956-b7e9-87b5366ad97c", "comment": "Malware payload (AgentTesla)", "value": "d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272512, "uuid": "a9b1e60f-463e-434a-b642-cc1af481d6c6", "comment": "Malware payload (AgentTesla)", "value": "f2b9f3e08aa8afda8172701073b762a2941e988d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272512, "uuid": "fc36162f-7ad7-471a-81b1-c4c4c36a13c0", "comment": "Malware payload (AgentTesla)", "value": "5d7841776b1fab808e2f18bbd2f344a2e2e50629bb696e2b1c62d6e878683634f4af5cbeec8f435f455a1f7ebfd8fdfc", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272512, "uuid": "8b4bd2c7-e6ed-4161-875a-3249457180d3", "value": "T162E4336CEAEE3DEE06E791C22602875B8936454F74122CA534F43EE278BDC79B71560C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272512, "uuid": "bed44b7d-4395-446d-8943-24d3abe14675", "value": "12288:2XRFhQ2r+aMlaV3ZRAKHoy77PI0+NQHZUgOP+0wC7dLJzoxYq:IRxlDJuGbVSQ5Ug50wC7non", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272512, "uuid": "04bd9a7d-ddbb-48e1-ab27-408717116f7f", "value": 700090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272512, "uuid": "87fd29dd-08a9-4130-a65f-7ddc5ff4421b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272512, "uuid": "6f0419d1-da9b-41d7-8a84-37711a5d405e", "value": "689504271.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea396949-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298061, "uuid": "ac483301-9039-413a-9873-1a1ff178c3c5", "comment": "Malware payload (Mirai)", "value": "59810900bb46676a1ad8c1e60f639636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298061, "uuid": "c5e736fe-8fa0-492c-8472-23f2b347c2cf", "comment": "Malware payload (Mirai)", "value": "d2aeabb6106e6b9720b9d92e68b5e33b0b3de1c63af78ea8ef12f77e14dc7002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298061, "uuid": "0209fb32-17c9-437a-9220-cce5bb9836c7", "comment": "Malware payload (Mirai)", "value": "f7d6ea756c28993d03e6f2aeac0304e2b438363a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298061, "uuid": "8ad58b75-bb04-4be2-8900-857bc43acaee", "comment": "Malware payload (Mirai)", "value": "c66ca8a8df2668c0383eb73ca34a4693858225a46eb4abac53991dd364e70cd1efd6e0af914166209195d84873125354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298061, "uuid": "6ea63fa1-e49a-4ae6-a3d5-9bb8a066e5f8", "value": "T1BE83C51A2F219F6DFB6CC73547B78F209748339626E1D285D26CE9015E6034EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298061, "uuid": "832ad729-5218-4c50-9ff9-91c138143cb1", "value": "1536:fdHnpKJaBcQcEG7ntMggskFtY27mkHqxr/34j3lhj333BgzrneLhT3bsR3p:ZnpKJ6cQcjfgDFtY27vHqxOknChT30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298061, "uuid": "db721529-9c04-481c-8ae9-317d5d234c75", "value": 85224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298061, "uuid": "1a9f8cc0-2dc3-43c4-9766-467fb0ce42e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298061, "uuid": "576f8dfc-6a9f-4ee6-8929-33abeab8b997", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6a6942-d540-11f0-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1765313424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313424, "uuid": "eb883c6b-1328-4c55-bb4a-25956ab105ea", "comment": "Malware payload (Loda)", "value": "aa123720fabb68d0459499da33e9a505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313424, "uuid": "6d167435-de1d-44de-9cde-1a990a01b92b", "comment": "Malware payload (Loda)", "value": "d2d3dfc391c3b7e6c6ed519bc7425d5a6049361142e33004022453ab68c1e293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313424, "uuid": "19fe988c-0158-44bd-820a-f72786448a08", "comment": "Malware payload (Loda)", "value": "1ad5db163dfe10e883bfcf62374565aeb425b8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765313424, "uuid": "dda92c11-f2b1-4575-bc48-3416a9d6241f", "comment": "Malware payload (Loda)", "value": "b4a46c8ac60044560d66191f7a878b8935573108231b5a0e0944e66657bdb1c5c29c83cfc5e289d4c3f8d403ccc738b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313424, "uuid": "87ddbefd-d9b6-4239-814b-2d2389992092", "value": "T18A35F1E1A784C465E86796BD9437DAA7A423B21ECC6C091D3C95FF0B7D7234740238AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313424, "uuid": "1479d2eb-a2ea-48c3-a63c-e202d0ef2194", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313424, "uuid": "706fa853-645b-437b-a602-47ef4151dfc3", "value": "24576:WhloDX0XOf4IAkOKGDu54PhfadTeNNajpDZBs3pKI:WhloJfZAkOKf4ZC4NKpDA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765313424, "uuid": "13351bb3-8a0b-49e6-b83d-b4c0b331b656", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765313424, "uuid": "a34c22bc-b09a-4051-8fd1-73f0307a8258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765313424, "uuid": "a1636493-7c6f-4292-8bf2-adff515d2c81", "value": "DXZLFK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddf5671-d51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299114, "uuid": "cee56edf-bc6c-4656-ab4b-b03643addf4a", "comment": "Malware payload (Mirai)", "value": "41e49538242580603c814cb83b5951a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299114, "uuid": "3bde598f-25fe-4c47-bfa0-3f94e83a34ca", "comment": "Malware payload (Mirai)", "value": "d2d6f116d381ea32e71837a6c5914da72b398af738e33000129e126beb876d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299114, "uuid": "6a78b02b-5a5f-44d2-a97b-76bfc275c06c", "comment": "Malware payload (Mirai)", "value": "5473d6a24c63cd260f41b171fbc88417bc85f770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299114, "uuid": "7561986e-0e77-453d-9e30-792a077d2597", "comment": "Malware payload (Mirai)", "value": "42083280f932101bf095a738ddcb911a26a99d148a5d7ca64a9e0d55ece1885f6d6207e22e24d99cd35829d19919d4e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299114, "uuid": "7e4b7a42-e882-4ac4-a70e-e91339b6c8ea", "value": "T175630985B8918A17C6D462BAFA5E41CC332613F8D2DF3207DD11AF557B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299114, "uuid": "ed4eaf7f-4584-435a-9a5e-a919adda105e", "value": "1536:U9jI7IwubXem/08N04/QROlTV/tUT3bsR:MjI7oNJ/7tVVUT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299114, "uuid": "c0c572b9-f282-4f64-84b5-189767aefca7", "value": 66720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299114, "uuid": "5dd97689-204a-4f57-8842-f3fdcf0bf30e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299114, "uuid": "06d9bcc9-57bc-47d0-badd-825a4c48bb8e", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e3bc95-d523-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765301038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301038, "uuid": "ab4f4468-c1fe-4423-9a37-a0d9b8cb928c", "comment": "Malware payload", "value": "ab7f92535a5129c7964e75878c8ee03d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301038, "uuid": "52de0d62-6aa9-4cd0-915a-6757e85a2382", "comment": "Malware payload", "value": "d312b7d2b222c277fece8362dba468fdc4b87603e9291110820a21f2304af643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301038, "uuid": "636aefcf-d57a-4574-9ad1-dae6dd9b23ca", "comment": "Malware payload", "value": "515f67027e14f3a184292c2db59a02c9df4e6c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301038, "uuid": "3da8f6ee-3f0c-45ff-817c-0774e7dd7e40", "comment": "Malware payload", "value": "d784a210f9de0a3725e270e3b05123bef57f0501efb854f6027b071e746d49922843494e6a19400d02272d654124e105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301038, "uuid": "4d4f23df-1f65-4ef8-904c-81ac4167b191", "value": "T12A43F881B8918A63C5D462BAFA6E42CD372623F8D1DF3207DD11AF157B8982F0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301038, "uuid": "c1c27b80-9d27-4d2a-b1be-26971044a200", "value": "1536:DysnOibQq1y9DZZNzRsXx8iRcfEqKT3bsRY:msnOX0XKtfEqKT3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301038, "uuid": "f0621333-174b-4a3d-85ca-62776afd7477", "value": 60556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301038, "uuid": "a38aaa74-713d-4778-8768-0f325635b9d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301038, "uuid": "fe010242-6894-4b7d-822d-a370c3f3d307", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d6f0d4-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298059, "uuid": "a018c178-8868-4a6b-acdc-3f9041334a49", "comment": "Malware payload (Mirai)", "value": "d1cf5aaa2e4db59fd94c6928c8850f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298059, "uuid": "2c5c21b2-5842-45d7-be80-f2ca0264bf69", "comment": "Malware payload (Mirai)", "value": "d35b40a229b395a06fd9a6b347ff9c604984739ca0f519f890c5b65bd06c9f12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298059, "uuid": "d1dbafcd-d35d-43f0-8117-efd6fc93e2e2", "comment": "Malware payload (Mirai)", "value": "ff7dd4ea8175060fcaca104716fc3193421c3bbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298059, "uuid": "b863c732-d1f4-4e01-983e-1d87e46079e0", "comment": "Malware payload (Mirai)", "value": "b7b38007626d0be6b72e39d4b9daa729b194a19635d0912610950f551ada40c57c3825fad7f0078545047c05d3c7f425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298059, "uuid": "47680c2b-c037-4739-897f-b5d424c0c725", "value": "T1FF83F746F9818F15D5D922BEFA1E42CD336357B8E3EF7202D9105B15778A82B0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298059, "uuid": "08238fe4-122b-4b33-a5e0-c2273913b3e9", "value": "1536:GRnZ3wElY0/6cEIW0sJcTU0DY1qWW6bbir3rYSllkLinPi1ViT3bsR:8Vlh+h001qWW6bbir3EePi/iT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298059, "uuid": "0f034612-d6c4-415c-afd4-b50a2a2dbad4", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298059, "uuid": "804b5cc7-6404-4e4c-b672-ed4248b9b0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298059, "uuid": "a711518e-185a-4b45-9bf4-46860c959d82", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f1246f-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298911, "uuid": "eb5edd4a-6317-453d-b549-a0f983f4ef0a", "comment": "Malware payload", "value": "177998911a24f74a5fecf92283604d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298911, "uuid": "5c9619fa-99da-4a30-9287-bda934aeb7ec", "comment": "Malware payload", "value": "d5526bb2f91f8e98183d5faeb8fea5d0a0342a21707d5558319a22972d74beed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298911, "uuid": "50eac93a-40cb-4898-8016-379ee4f6b9b7", "comment": "Malware payload", "value": "8c491d19610f28775882de85e483e58b95ef4970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298911, "uuid": "c3d8a071-9e0a-4fd2-b4bb-c7c81bb2b2d8", "comment": "Malware payload", "value": "cfe5a6edc114a247134440d03a3766a725226ffd63a4ef72af3c24dd553c2c72ec644e06406f418b3a29656152528042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298911, "uuid": "16c7423c-eecf-4f2b-8b7a-e8db5a5eb971", "value": "T18A83D71A2E25DFADFB68C73547B78F20974833D626E0D285D16CE9015E6034EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298911, "uuid": "bd53b8ad-9511-4157-8617-6c3a2711a037", "value": "1536:6ednnJ7JahcQckG7ntMA6s+Ftb27a82MNWr/34j3lhj33khIg7n3rBT3bsRh:6GnJ7JacQcD/6FFtb27T2MNWZPnbBT3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298911, "uuid": "277b5a67-12b2-4f8f-aa69-7762f0613c67", "value": 85192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298911, "uuid": "9782c7b1-14e3-4180-973b-111f641df9df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298911, "uuid": "8ed60b47-f8b2-4e5a-a3c7-f5a8e06968aa", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0021499-d549-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765317291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317291, "uuid": "a7bf7158-bd05-411d-ac9e-69f401012c56", "comment": "Malware payload", "value": "0a6cf6348a4863b48c37f3ebf0a14c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317291, "uuid": "7d94a233-0543-4948-8e86-e768726a3a25", "comment": "Malware payload", "value": "d7a86dadc15ebf5cc064a9d9b413093854c25fdb6b06d3710300fcf4ffc79519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317291, "uuid": "13255fc9-dfba-4892-8ec8-30d3a79bf1a6", "comment": "Malware payload", "value": "cc3d3860824ae38fc5f0701cccb5838af5d9fe48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765317291, "uuid": "5a949769-f18c-4617-9a83-5c843f145cfd", "comment": "Malware payload", "value": "72ee3d7d0dbbbd8387fb8edf7c6a735326d6bd534c49af41c12f2787058a55c2d76721e4ecf513349c801a3ab0036c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317291, "uuid": "562f209c-8365-4198-aab0-a81487ca3a66", "value": "T16618331C7F14ECD5D06DB27FA7F225341A216A070D627F5B03BB899FA09CA26A734271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317291, "uuid": "7fd138d1-79ac-41c1-80b3-8875eec21e56", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317291, "uuid": "253b8458-2797-46ab-ae63-e2fa329ff228", "value": "1572864:8v+BWMFDe45kFpYTOMPz6hDRVO2mJhh94iybSgq/hQv5n0PaRKrMzgBXCOwffoGT:8WBFle45opgOMuhDRVkJhh94ilgohQvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765317291, "uuid": "cf6b42f8-1d50-4a6e-85ee-14aa233e4a12", "value": 87915625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765317291, "uuid": "23c13bae-2651-4671-9c53-27cf15d616c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765317291, "uuid": "67e82042-0004-4bb0-b727-41a2312a711e", "value": "WizardXray Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03405507-d518-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765295955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295955, "uuid": "08641040-cc87-4bad-b4ff-3bc6d53c7253", "comment": "Malware payload (Mirai)", "value": "b76b214f5ba9dd55eceda3197d7742d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295955, "uuid": "68c7b6e4-f52b-4ee5-8eff-86a6e833925f", "comment": "Malware payload (Mirai)", "value": "d837fa18bab96ab2a31ec9ab5234b0df8fb1a057d2eb1d09585f75397d977399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295955, "uuid": "0a3da69b-ddee-4a04-8f26-23cee9122e72", "comment": "Malware payload (Mirai)", "value": "b4228371e4693a3a8360116805541876eeb120c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765295955, "uuid": "118a7ee2-9546-4a27-9285-aa8ee6de31ca", "comment": "Malware payload (Mirai)", "value": "aa2a4d43aec727c39e466022375383e185bf1e6640b471c40a2b161e369fb9be375b1b66db1b341e4ab10995793508cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295955, "uuid": "9bc84801-228a-4369-abc0-9ef52868563c", "value": "T1D813E786B891CA52C5C5A5B7FF0E82DC371613E8E1EE33039D15AB257A4B82B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295955, "uuid": "79e86bed-9385-47d3-9ed7-254b40807297", "value": "768:39nSAyCW+6CzH3qMi0X8KiKdu4rr/lzrhNevV8BKkJGCqN1xeTT3bsRGn:tnSA+ZCzL8S17FavKXTg14T3bsRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765295955, "uuid": "375ce545-be64-4a0d-9b14-1f358fc9645c", "value": 44076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765295955, "uuid": "fb78894e-5217-4830-8861-1db2a977b396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765295955, "uuid": "e7a3662a-73db-4116-8408-60541386f77e", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb46a2d5-d522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300559, "uuid": "867bad32-3315-4203-94d9-f81e51881a86", "comment": "Malware payload (Mirai)", "value": "7b99d8fac6a8c86c8a8c468225350d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300559, "uuid": "dbb5cd20-e4c0-45d8-ae95-7433e5dedf2d", "comment": "Malware payload (Mirai)", "value": "d92e097fc0dbf6d93cdb1a54cf4f5a14f294a702fd36bb1fc0138411c184e872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300559, "uuid": "a1bd2ff6-ba98-43d8-bcf5-64bb3c51e74c", "comment": "Malware payload (Mirai)", "value": "adfcab4d89d2305c8a2f0d5740c5aea5d96bddae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300559, "uuid": "fe206a8b-9d95-4e1c-bfae-9fa1bf4a8bcb", "comment": "Malware payload (Mirai)", "value": "574787c218bab265fb93eacb85d1db35c8e58523d63a7654b8a7e0598e1e9609fbb4c7a397293ffea45141df6e3776ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300559, "uuid": "946fc3d3-ae41-4383-b68c-ea68861aecb0", "value": "T1C0D3AD8BB24F1910C43207F417C34B9E6A6322168E17C9EB2E1E667B3C7D5DB6A167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300559, "uuid": "2da73afb-a95a-4406-a9f0-da0b098326bb", "value": "3072:2Irp6POdaUwLIVGF67QWvOUMgtTonCfJPgen+q:FXOMsuM/CxKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300559, "uuid": "78fdbb35-c749-469c-b51f-a377d13604bc", "value": 132456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300559, "uuid": "740c5ca8-f27e-426b-a4bd-032b904a508c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300559, "uuid": "148220e4-d4a4-4d46-84a1-c40a4adc80e2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c26baa-d55b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765324727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765324727, "uuid": "dcb14993-22a4-43e3-a3ba-772877af3c7e", "comment": "Malware payload (Mirai)", "value": "825047695fc16c6edd7ea5cf29ae0b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765324727, "uuid": "64941f08-587c-4220-8b2b-ced8dd2415e5", "comment": "Malware payload (Mirai)", "value": "d96c145ba37063e11eebbc0fa2c14428b126ef11ed96578afe9bf860274a8b79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765324727, "uuid": "f1e83e03-e3af-46fb-ab21-e43aadb6acc0", "comment": "Malware payload (Mirai)", "value": "e55f8133365754a329a4b542fcf30911f9b7c8aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765324727, "uuid": "494eb6f5-8f34-425c-9ec4-4d0b2fd399f9", "comment": "Malware payload (Mirai)", "value": "9503b0b1684367ce8fbe59bdb8e206ffafc154e9a7811099cec82b0fe801a4324c30da48a87205f91e505d6ccfa6d491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765324727, "uuid": "9a161c4d-8033-4c5b-99b8-76ace07fbb6d", "value": "T12DB33B45FCD19622C6D2233AFA5E128D372663E8D3EB32178E215F21378A91F0D7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765324727, "uuid": "fc808553-9719-4822-93a0-be5da85130f4", "value": "1536:F8uYy76NyWJHy9bg2NeTqnX8y/Ny+X7c1wHhZB+OTqCKuz7e+oW6ijvOB:F8uYEEk/Ny0CwHjogxzOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765324727, "uuid": "a0d825fe-70e0-4767-b75f-a966c82bd037", "value": 117240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765324727, "uuid": "93eb0c00-48e7-4ed9-b892-725049d5e632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765324727, "uuid": "e2d9daf4-18de-4fff-a755-1d85d1d4f564", "value": "colonna.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a7728c-d557-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765323157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323157, "uuid": "68e02f0c-05e2-4636-ad91-c0872b583bf1", "comment": "Malware payload", "value": "0633e2650d4554021c0069c058f97339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323157, "uuid": "4bfd8417-f96b-4816-a6a9-58ef6b684b52", "comment": "Malware payload", "value": "d99788669cdc088c8935d64961332d5ad5cfee4fd71ff1f2115078f4340a6a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323157, "uuid": "dd1202c2-574a-469e-9bb7-c2654f8c7dbb", "comment": "Malware payload", "value": "e0a0712f8271684a96211549cb87ec16b31cfeed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323157, "uuid": "2e9443bf-290b-4c9b-95ea-088c7abfdb67", "comment": "Malware payload", "value": "e7ad9dc819abbdeebf6261418414e444cd5e31165621e3d7826e0193d05644dfa87d0ffbd011274b2b4577f39d008052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323157, "uuid": "35a51b8e-7c09-4db6-9337-ea3edc62e8a5", "value": "T10EC33B89F6D2C8F0FA63253514B49D625F2EFC151E505D9F338CB66A3E302818966C7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323157, "uuid": "3cd604e5-bf1b-45d5-b91f-0b1ab94caf1e", "value": "b0647edfba065dd7e9621a34f2758522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323157, "uuid": "68cfa808-a2cf-4ad9-9fe4-67fc8986c49b", "value": "3072:GtnlNjEh0w8oX7HoNxstG6eCYxxdV/atYpfSb:ezW0e74xdV/atAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765323157, "uuid": "dc6e66e9-982b-4df3-ac58-6b6a114e4690", "value": 122320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765323157, "uuid": "19425d96-5bf3-4f75-9001-c822da5aad30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323157, "uuid": "7dcec85e-093d-49da-acce-2ff4053395d2", "value": "Side Effects Documentation feb25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb34de04-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765286037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286037, "uuid": "706c0fe7-997e-4f51-b56d-4653b04d2c5b", "comment": "Malware payload (AgentTesla)", "value": "f74243eef36a7a4bf53cc4b384a84689", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286037, "uuid": "35ae22ae-9cff-40a8-91f2-481a7f72d993", "comment": "Malware payload (AgentTesla)", "value": "da60f22596681e7a20510f0a1c77a3a82ab87490d07f7955efc672237a2f3491", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286037, "uuid": "cf1a4bad-a2bc-4657-86a8-67c98c9a6f21", "comment": "Malware payload (AgentTesla)", "value": "df69d4be362c5ba11675fb3cc9e346a50d14bad6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286037, "uuid": "d25a197a-511a-4dad-b6bd-5e00d377b156", "comment": "Malware payload (AgentTesla)", "value": "49bb499c3d18b390b1813ba2b2988fd922ef9d1c6f14d73be522f8422183feed88358741bafd3edd68c17f0bd7e3dc02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286037, "uuid": "ac1c57ab-7706-4390-95cb-d3d2d837ed32", "value": "T195E46D30DE3402694F4B1BDAFDA50A618ABD861D463654F2F2DD030E610A5FCE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286037, "uuid": "a173cb54-399c-4d21-b827-5f73681ee91f", "value": "6144:bw1wWw1QwTlwFwVw1Uw1Ww1Mw1tw1sw+w1m+w1Sow1d1y49:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286037, "uuid": "16a6bd10-cb7a-4551-ad6a-924e3cc8e9c2", "value": 719907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286037, "uuid": "3b716821-9eeb-4b34-844d-69a5e78fd35e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286037, "uuid": "c6517426-e7d5-4eee-a6be-9f89a04102e8", "value": "contract 01-2026-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295f1570-d531-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765306757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306757, "uuid": "e7c22855-a700-4208-ada2-6fbbf3d6b3a0", "comment": "Malware payload (Mirai)", "value": "565f09cb89104b9daed096358e942cf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306757, "uuid": "5985f094-0036-47d2-ba10-ca0bdb565f04", "comment": "Malware payload (Mirai)", "value": "db72cdb5ae27046822e32a6fbc41cf200c1df177ab3b94a367f7ae7a5094d6e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306757, "uuid": "996cf5d5-d738-449b-a81f-55a2bd605185", "comment": "Malware payload (Mirai)", "value": "f50c3d4c8b776a7cf00c65654e1a62e0f80d5d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306757, "uuid": "74286a61-03f9-4450-90b0-9f63d60a393b", "comment": "Malware payload (Mirai)", "value": "0a29283124848b0c0945169eab4b8a3118bfea59e4006da2699bc3aac524460ffefeb4cda709037dfffc9add86be9ae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306757, "uuid": "8093a1f2-84a2-4603-9105-d01687bf7ee0", "value": "T1E8245B81E683E6F2E8450935502BAB321D73E576713BDE82D7ACCA36DC11642C52A7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306757, "uuid": "b8311bdc-2f61-4b6b-bb3e-43e3f2dcaf8f", "value": "3072:ck7tny2K3nrQh1GduoqyWLmv2AaE8lFmBk9/G+PpKn+3d9NkrwkwARF6Vr:ck7Ny2K3rg14bRvG08V3jyrrwARF6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765306757, "uuid": "406408c3-2e94-44a3-9634-29d9c846b352", "value": 213348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765306757, "uuid": "b794c199-66f7-4eb1-81b0-2d547ab5b565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306757, "uuid": "cea94c1d-53c2-4a7a-90a3-de6350ba7ab2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938e361d-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252389, "uuid": "d6429924-6706-4f12-8449-2473061252a5", "comment": "Malware payload (Mirai)", "value": "41d54c84cad1da9b2c8741430c304c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252389, "uuid": "915cdfb3-37c4-4e4b-bf13-2bd60dd455cf", "comment": "Malware payload (Mirai)", "value": "db75c1c7488822f400b28f6c13a02e3284d7ff4ea5cf15f83f866bf72bb34887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252389, "uuid": "bb0dd33a-b981-4e91-a8a4-8a8540c12b1e", "comment": "Malware payload (Mirai)", "value": "f62585c314c8cf3cc8b20a7f2206cdd05e6a9495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252389, "uuid": "28f5e3e6-3aed-4a9e-9ad5-c3cbe87ae02e", "comment": "Malware payload (Mirai)", "value": "58981fdfb236d3fbdd4742ee165d87b03bd5333ff4775b23782d0d2784b3286e7a62f502414f5b992525596f9fe49e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252389, "uuid": "6a754024-a491-4d83-a827-8c7cc20f0df0", "value": "T18AC3E606AD429B01D59735FAFB9F418933536BA8E3FA7101DE206F6123CA9DB0F76112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252389, "uuid": "c177b544-e4aa-4762-bbde-776e86f4aef0", "value": "3072:15DZWd3kbJNzE7zTbA3lI/ZkdkxmEOaYrCa3W3gKVqR0YBCwjy/KoOimL6T:15DZWd3kbJNzEHTbA3qEgmPaoCa3W3gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252389, "uuid": "d0e61afc-c8a5-487f-bda1-6a69b37aaa38", "value": 129520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252389, "uuid": "5bf407fb-9ef2-495c-9256-50620bdfd1df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252389, "uuid": "062ea6c5-0126-4f8f-9180-ddc488b3dde8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f341e573-d51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298506, "uuid": "c1148de8-96cf-4308-980b-a10dd3683671", "comment": "Malware payload (Mirai)", "value": "7fa4e707ae8cd2e8e61cc4180fffc313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298506, "uuid": "584d45de-c70a-493d-a151-b1eb5c6a7ebb", "comment": "Malware payload (Mirai)", "value": "db9001f168acd38c038d3ba3c722cb6a7e1104f38acfcf0820e685c3830c6867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298506, "uuid": "681ce57b-43eb-4b4f-8d5a-8d89d5f7f850", "comment": "Malware payload (Mirai)", "value": "3c839f217938dd8b9cd5da8daca59dd07433997d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298506, "uuid": "4ed4d745-f66a-410c-96cd-f5fbd470e0ac", "comment": "Malware payload (Mirai)", "value": "8c5d530f213ac352b052653d4da0846814d9ea2221d3451454cd33394f1e63abde0c8a3a596ca91fdef1f1ac77c5a7d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298506, "uuid": "bfe5b5db-273a-46a2-8402-d1b5564d1e82", "value": "T19E536C217D753E27C4C5B87E21B34334F2E6274A25A8C75A7D721E8EFF01A442507ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298506, "uuid": "b30f59a8-9ff4-4cfd-a4ca-a3e4bdf74b2b", "value": "1536:bgGv1S4yQo+w/CYLH8iFyf56lSVWGJxH+szVT5KzH7LhV:bjsllHLqOYTvKzHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298506, "uuid": "19d0a62b-98ee-43cb-b402-cd970b81286f", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298506, "uuid": "b1d91f59-d73a-4c20-96ef-af2b73d54a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298506, "uuid": "97baa301-7018-467d-8c17-ebc904f8ff1d", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64678b28-d530-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765306426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306426, "uuid": "f3c63f56-e947-41ad-a785-3d26f3f4a6a4", "comment": "Malware payload (Mirai)", "value": "45f58c2e8decdd4d040a298f126c5d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306426, "uuid": "46e0e469-1a08-4e4f-be15-869c53914a21", "comment": "Malware payload (Mirai)", "value": "dc9b4d1471053e70bab3754ca4eee5e3c1efd4841f3bab122c012ded8819ec98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306426, "uuid": "61614faf-709a-4f50-9bc3-1ea36f0e287b", "comment": "Malware payload (Mirai)", "value": "b681c8804f900a49a9078fc242ee38a5c072dd6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306426, "uuid": "702cd906-2baa-4148-bbb2-d1e1590aa1a4", "comment": "Malware payload (Mirai)", "value": "bf2c3c0270c0447933bc31849ec18e778f923d30aace429616174679151509b1089ef8ba47d6fd7aed69f267b14b8611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306426, "uuid": "67345bb3-dc8c-4c17-a7a2-38b66829105f", "value": "T156731297D699FC09CCA6853A9CFF3CCA154BC859123C2F20DBA164F74594AC44B257B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306426, "uuid": "b999eacd-06dd-4bc6-8289-cdd4f31b4fcc", "value": "1536:ZZYxiO8OdPa8NVe+J5HipoVQLlelX15YxgSstmJ/SDNTnouy8HyM:A84vHViFRelX1+xXKmONroutX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765306426, "uuid": "8db28d71-6b5f-4c43-a97a-6217ac2d0692", "value": 79676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765306426, "uuid": "91002125-b6ae-485c-b4bb-52a345776469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306426, "uuid": "37137ce2-98a6-466f-b713-f94a1941b06a", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeecb22-d50e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765291947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291947, "uuid": "11bc020c-7a3f-4c60-8592-13197cec009a", "comment": "Malware payload", "value": "8ccde13d5ca60e39bbd24fe34cfb7743", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291947, "uuid": "ceaafae8-45ba-4fa7-9c51-60d9dc7a0696", "comment": "Malware payload", "value": "dcb76c24685fd31d5ac64851fe8e3b41a4462d882eda656fbc7faac89a763f8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291947, "uuid": "38a3c6f5-c0f9-4c04-99a8-44ce65f8a461", "comment": "Malware payload", "value": "80f48bf48374f354417265fe53fcc35e251b25a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765291947, "uuid": "dcdcddef-443d-4d36-8492-6560de85e7cf", "comment": "Malware payload", "value": "ad185a2b1b89ac42699a3b94b6f23f64d428e590edbd70bee204ae8a3495e25d4f4585a0434898d796685513bdfabd83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291947, "uuid": "063f9e76-7128-4dda-a7f9-9f77cadc0e0a", "value": "T1D645E062BA42C0B2E49A0030A6B9DBBB2D3D35B9072490D3F7D5497969301D3B739F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291947, "uuid": "47aa40f1-f898-4d1e-952b-6b6f6b45aed5", "value": "d15363fe7543b1a474001ec498c42e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291947, "uuid": "488530d1-fcd5-41ea-9809-61cbe3577c97", "value": "24576:HD5JU5xVmm+6uzofz/jNCcF0kJLrpVIiEsXwteQelECCAYuv:dJexInRofz/jt0opVcsgteQtNAFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765291947, "uuid": "691b5c1b-8776-43db-b829-4176e445ed0e", "value": 1273488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765291947, "uuid": "9a22d1eb-99d9-45df-9def-1359345fe5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765291947, "uuid": "b21183ba-a748-49f2-aa59-83894dece58a", "value": "wdll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9675559a-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765264420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264420, "uuid": "a1603241-f60b-402f-8d21-5b4484bc68da", "comment": "Malware payload (Mirai)", "value": "162c482a91c8d7c0891201b2b6833dc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264420, "uuid": "9d642983-5c5d-44f0-8fb7-d13d7ff338d8", "comment": "Malware payload (Mirai)", "value": "dd2f4ce04cf9949d6a25f2b34e683e0b55558341fc5f461c2326d1d469e5cec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264420, "uuid": "5fb37d24-0211-45f4-a59f-cf183b407a44", "comment": "Malware payload (Mirai)", "value": "2238e620043d42fc26ea6aebe0389e9a6b0fc61e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264420, "uuid": "2c057e8a-13d9-4ec5-b975-5b2f61bd8b06", "comment": "Malware payload (Mirai)", "value": "a1f39b191a9ef5d3f36d6182a14d1633d911dd175f62b63c3a75a8bd8014243b8720cd9fcadaf4f452dcab860c283659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264420, "uuid": "5d32dbd4-239c-46ab-a53a-fecb3c709bbb", "value": "T173F45C06BF406FEBC0AFCD31896EC35711EDE98756C1662A71BC4B8CBA5D2590BD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264420, "uuid": "7bd2f97d-15e0-4f19-af18-4fa3bbdb8513", "value": "12288:5PCTC984Tw05Z6F1rIGxuy6creAY1Hym44/A71CxYuGK8uKldWaPCZI39BlYfwWz:E717JeI/ro/Zh58HZMe6YIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264420, "uuid": "b9fefa2b-cac1-4df5-bf37-fa7a6f35ff53", "value": 755620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264420, "uuid": "0d4776d2-694f-4c64-84c5-dba241294d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264420, "uuid": "dd15a88d-7ea1-4bab-ab66-ed0f5c037b18", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202f64ff-d4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765271952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271952, "uuid": "7b911e53-c64e-4975-9927-9e2694ef0690", "comment": "Malware payload (Mirai)", "value": "dcf4ccf89e6927a2ada2d1fe7692d144", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271952, "uuid": "ba704c99-4f1f-4de0-bf5b-fc17939121be", "comment": "Malware payload (Mirai)", "value": "dd7685e9a76cb706eaf0091fb626eee5cb7200752e7540aa8d328bfff6472710", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271952, "uuid": "c3149d9c-31c7-4446-81f5-57d58cbcacb3", "comment": "Malware payload (Mirai)", "value": "216930fef40b9f744a89918e38604f14546b629e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271952, "uuid": "68921b4f-80bf-45c1-8220-678848f4010c", "comment": "Malware payload (Mirai)", "value": "676d6f89800bb6f937280b6a215b7cfc97a66a232e104f77ee526b1c9b8025a86a7e4fc3e9857d382e63bfb500e7cef7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271952, "uuid": "888eec93-5971-4dd8-8c41-d11a40793bb3", "value": "T15D1148CF08543446898CCF8530A648C4B6FDEED47024060BAD88BDF7E088917B9B4FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271952, "uuid": "cd978c40-94d5-4fdb-92d5-31f5d80471cb", "value": "24:QE5WxEcpfNIZEtMvEVKTjb3E3eMUzEOfRMETqOEHK3EKPFiEzcA:nWvpHMgQjbEehzfRpqTKVPFzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765271952, "uuid": "512e4481-08d3-4332-a9bc-eb6ad9090167", "value": 957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765271952, "uuid": "3beb2053-570c-4ae3-85fa-896604316ebb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271952, "uuid": "9c742d60-c16f-454f-ab79-ea436f51ec66", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e65148b-d50a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765290122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290122, "uuid": "ee35990a-f5b0-46ac-b194-66a4365345fd", "comment": "Malware payload (Vidar)", "value": "36eadfaac8a56dc2b4dc5f53d01e50dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290122, "uuid": "a7ed2ef6-3dba-4dc1-a1cc-ff3200623ea6", "comment": "Malware payload (Vidar)", "value": "dd7982ab2a59c5ce1154be78f68fd6e237734ee6883b949c106ea616c33e6fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290122, "uuid": "aa07fa87-b729-4efd-ad0b-eff817037349", "comment": "Malware payload (Vidar)", "value": "a5926579ccb503b53c9bfc7d39cc0392dd6a4e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290122, "uuid": "204d9c0b-2cf7-433c-a42b-3fc9392f5877", "comment": "Malware payload (Vidar)", "value": "11218a12d018d0909364ab6d44cb781629a9eaa369e29a951503007383b95d2159e5c3720d364e709391c7eb709bc786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290122, "uuid": "eef4c445-6e13-43b7-9527-0f4cfe51c865", "value": "T1C0C63A92F9956665C7AFF234D05062547B70BE0943302AD7AFE816990C3ABC4173FF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290122, "uuid": "c7d33e10-d300-4869-8d17-7e4a481a7f01", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290122, "uuid": "c1efc627-8f08-4da5-8e28-08dcbf8537d6", "value": "49152:WE0F3Et+Q048r3mlFP1seydNu2zVLxCIyyPI0hBqfLg/UJXY909NtnkCFtZev6zB:WF3E5lFd/iNu2ZxRyy3DcYKtLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765290122, "uuid": "87896153-ef47-4d2e-af70-8addf27ba2fc", "value": 11599488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765290122, "uuid": "e8921277-06b2-4035-9c4e-8a9ef8d723ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290122, "uuid": "74ff0792-c47f-4e7c-8a14-ed04adf2c574", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75794a1-d525-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765301895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301895, "uuid": "93826ba1-8b8d-4e7e-a2c0-76d89bd7f683", "comment": "Malware payload", "value": "9c5e31bb981b1327945bf72754121047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301895, "uuid": "2022b730-26ee-4ae6-b0ae-4c2fc71dd808", "comment": "Malware payload", "value": "de470e0da381af699674805afdc42c7a425d458d04afc446363402231aea5047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301895, "uuid": "4d65dbe9-d1a2-467c-91f1-a9bd3c24e1d2", "comment": "Malware payload", "value": "6d0496bdf509c8de8d16420c6aff3e27402b15af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765301895, "uuid": "5ed44515-d2d1-4515-af9f-6a42188004fc", "comment": "Malware payload", "value": "a735196857cf137c557215f73c5cac1709e7bd7473a3477a7936dbb5618808a1b67006052b4f698b051ef3d45668387a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301895, "uuid": "33f6a0ba-ddc7-4f8d-950c-75580079502c", "value": "T12E534BC6A800CD7CF94BEA7BC91E4A05F554332556820F27B6A9FC936D720988D3DE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301895, "uuid": "de65063e-f212-4140-b447-8bd657cd7207", "value": "1536:lgdMIvNXvEUgEHntYfYYYYYgEAOwKH8uFx3EdKSWDZH2+3yP5X:lgdMYEUHGYYYYYXAkbx3YW9HBUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765301895, "uuid": "5e2bf301-8fc0-4912-8b6d-f09095c801f6", "value": 65752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765301895, "uuid": "60db031c-2375-4fe8-be44-942fb2f55916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765301895, "uuid": "73285acd-399a-419e-bbc4-668b196b5ceb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c9c4ba-d4d3-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1765266484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266484, "uuid": "a000fb33-8289-4980-a95c-52555daa6803", "comment": "Malware payload (DarkTortilla)", "value": "711fbcc28fba4fcfbb4f02aa94db65f0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266484, "uuid": "925a1813-9ddf-4718-b9f3-71b87b07d622", "comment": "Malware payload (DarkTortilla)", "value": "de7f47628188cb1ed46708ec2c9f3361f8e50cbd320f9912adeb209c8957bf39", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266484, "uuid": "9ef0afe5-4d2c-4771-b753-b89161ef377e", "comment": "Malware payload (DarkTortilla)", "value": "8c9d0359271f99e1a0fc76a707c6469d90516566", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266484, "uuid": "b22820c4-089e-41ac-b6e2-ed322079172f", "comment": "Malware payload (DarkTortilla)", "value": "5f029c713f85d4aa0c55db58e38e8263aaa62ca20c740ca95726f74d6fcbe391f05f2e3f3d3a760aac1962382f6c6e80", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266484, "uuid": "c0483358-65a4-4d05-b289-9942eb2b09e0", "value": "T134B4BE8553985FA4E8BF9B7C947004144BF7FC069E26EBDE2E496CED3921B808652373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266484, "uuid": "61e17c62-4b18-45ca-ab61-e76c5c7c4a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266484, "uuid": "ed90cf73-c04b-4d4a-9cac-7c169d05cc49", "value": "12288:Bs/pb7hrd2whqO0FIVEcyb3IBeVaPjec4UuBCWsWPUk8b:uBpPL0gEcyEBEuec4UuB//8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266484, "uuid": "5ec481c5-82c4-4fd8-a1c5-ce64583aaf75", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266484, "uuid": "732cef9b-08dd-4c8f-9fdc-6025ded9df4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266484, "uuid": "bb980ba0-5691-43fe-855d-acbc33a8d931", "value": "NEW_INQU.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fc4df-d4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765272310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272310, "uuid": "2ed19ab1-cedf-4d92-9cd9-79f6c2a3a779", "comment": "Malware payload (PureLogsStealer)", "value": "4fd7da886ec5687497dbd3cc9184d0f4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272310, "uuid": "85973877-4c31-40de-8e03-7dd9dba7454b", "comment": "Malware payload (PureLogsStealer)", "value": "deb64bf0edd1bee39cb1691cc99eefeca7a493316a316f79447edaa09c290d43", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272310, "uuid": "018a5947-b054-42f0-a926-205182974d99", "comment": "Malware payload (PureLogsStealer)", "value": "5a005d65303aaa1ffb813c76126a8df887c98813", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272310, "uuid": "ee4e817b-af4e-4fef-9d91-f99711f8b760", "comment": "Malware payload (PureLogsStealer)", "value": "0cef17c7cd58e3e3078f061c3dc8c9916b8c4ea1f8638caedf3d1b7716d86563962f33c7445ef8c36fff1fc3f595a4ae", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272310, "uuid": "1340ddd0-0519-412e-b59a-3ad017d9ccfb", "value": "T12E25333D03293ED3B549C5B4278B9C4923A8C6F65C950FD84AAC62FCA8A250E771F5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272310, "uuid": "62a4d526-0fa5-46e9-b56c-a685d4262ad9", "value": "24576:GDtQHk/AjgIqeiHcQcTApBtPWKbNSOj5rzQxujB:GWHhjJJiVcTA3g8NFJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272310, "uuid": "d0deb957-4ac1-4965-b853-6798a87a64cc", "value": 977404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272310, "uuid": "5afa68e7-fea5-46f7-b785-97312d7f1e3c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272310, "uuid": "cb6b600b-2b17-4575-864c-07c62ff475a6", "value": "Mbbank_07860731.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d032e1-d500-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765286056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286056, "uuid": "1897d5ac-67c5-4f2c-9249-b93a94366434", "comment": "Malware payload (AgentTesla)", "value": "467cf2e2f089cb2fa8aa328f35347a24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286056, "uuid": "2c340604-5279-4130-ac5d-7d3adb905185", "comment": "Malware payload (AgentTesla)", "value": "df0c1509903666df5d067f689b2c1b52b56488568a4def25b656a2e2d2b87f1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286056, "uuid": "5cbb6aa1-8250-49ae-901d-16f91d03b152", "comment": "Malware payload (AgentTesla)", "value": "bd752ed53f72913f4ae1e642f68f9fe41821223d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286056, "uuid": "a784e228-5b64-4058-b7d6-987a3bba234b", "comment": "Malware payload (AgentTesla)", "value": "95abfa9100a91d28a5b3ff8bf54bc3de171de80f3be8751322de7b3d0ce7a297b1e1e9a487e03cccede093fa2d4a8602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286056, "uuid": "9be7271e-d981-46d3-a553-d6e3df1de399", "value": "T13BE46D30DE3406694F4B1BDAFCA50A6189BD861D463694F2F2DD030E610A5FCE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286056, "uuid": "4517fb43-d502-4543-b444-db75c8f47574", "value": "6144:Dw1NOw1QwRtwzwzw1Zw1yw1aw1xw1gw+w1A+w1U8w1d1cj:81j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286056, "uuid": "daa3b5ae-6d3e-43ce-bf24-a804af19dc07", "value": 719726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286056, "uuid": "0dfb38f6-6738-43b4-bdaf-377f4d390c49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286056, "uuid": "1178ee8a-d0d9-4f1c-a472-11bfa586b1fa", "value": "2025-12-09-009071.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edff4a4-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248113, "uuid": "d47fb285-18f3-47ba-95a5-1a23bd7ae8ee", "comment": "Malware payload (Mirai)", "value": "77f0754a8a27349fb554ad155004275d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248113, "uuid": "3095d4ca-4197-41ce-9590-e1d5cad23980", "comment": "Malware payload (Mirai)", "value": "dfb90637ed3fa4e0d49aa81b02d16858a43c61a1541cd359f22b76dc06c97540", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248113, "uuid": "0be21f35-5643-433b-8418-f7789dc78077", "comment": "Malware payload (Mirai)", "value": "b4e21ccf476c93db4394348df58f0994e755003f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248113, "uuid": "8d0877c2-2d4a-4837-85b4-7e136485301d", "comment": "Malware payload (Mirai)", "value": "a836c685885baab13debab99e64c2bc00852caa1194f1c8965bfb54148db4cf112f567f5a97813233da4886f770f49e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248113, "uuid": "51a4617c-ae0f-4d9b-921e-3811ac81ad0a", "value": "T1DF34011AA7619DBBD81ECF3B02DA4542409D865A07DF9F2F77E0CA64E38650F61E3C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248113, "uuid": "ca0fea10-1c92-40aa-8ef1-675852ce2dc0", "value": "3072:3cxL9kyRI1s1j29FrvK5fOEqR/49qHEkuOSX:3cFn6q1C9M5ZqR/49qHEkuOSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248113, "uuid": "33592196-cdea-4c20-bac8-0c7fc6793876", "value": 240420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248113, "uuid": "87a8c060-6968-4b0f-9343-69fe2c1ac2a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248113, "uuid": "8795db0b-7fcc-47d6-bf16-233531028ceb", "value": "Demon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b63d2e-d4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765268611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268611, "uuid": "4d6de488-f9d5-48d7-9f6e-09099e2eae90", "comment": "Malware payload (PureLogsStealer)", "value": "4718dafba715152e862c513ac7d66ed9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268611, "uuid": "eef1684f-f507-47ee-9356-8ca8a0b2e6a5", "comment": "Malware payload (PureLogsStealer)", "value": "e0e7f7fec05c3d612a7840cd55c14eccfa71ae615462334f4e09251a91429ffe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268611, "uuid": "883e7b33-c643-4698-b51e-ccb33bbd79f7", "comment": "Malware payload (PureLogsStealer)", "value": "40e997cc38f42c6a6fad5af0035483e520407340", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268611, "uuid": "7b2148b4-1150-42f7-a279-94cc500e1233", "comment": "Malware payload (PureLogsStealer)", "value": "17edf947ceb045e76d22b950d18f5549f50c59bff3154e56088eb4613fbdbe493be2b8df2a67e3c33479ba9d236b2c9a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268611, "uuid": "bbaa27ff-4217-4155-ab56-5dabda284edb", "value": "T14616F29A035AA53CB1A712358E7C77C0F9E8956BB8620816B1171BC5DFE43B05FA4FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268611, "uuid": "df8365e8-4b67-41e2-a4f8-3d5b86d9f769", "value": "192:dSz+dSR06JFSsSUnr0S9lySuSnHGUsSP+So0/yx1mKppsW3ppmIppRM:XCp8PbfzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268611, "uuid": "ee83c9a8-d626-4ca2-99da-96b66e3a794c", "value": 4377875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268611, "uuid": "64a967c7-1640-4581-a7f8-38f47dcbcbc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268611, "uuid": "a6b4a2a3-3d85-4a87-b263-3fa1d3cf3178", "value": "PO No 602450.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619dcbfd-d518-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765296114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296114, "uuid": "2ce2bb44-46f2-4be0-bcf7-fb9ecefbd64b", "comment": "Malware payload (a310Logger)", "value": "5553b7e0c1ca57ccdf5cd0405e7f0d4d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296114, "uuid": "b0e1c79e-6a39-45af-98e9-3d5d47913577", "comment": "Malware payload (a310Logger)", "value": "e1639816682dfab588eeeaf7282aacaf9653183ba4bd1610d6e6777d714c9c14", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296114, "uuid": "48a04664-0214-4f63-917c-7a19292b06e0", "comment": "Malware payload (a310Logger)", "value": "1f277798f41a7e7bb3077cfe21b213efe668273f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296114, "uuid": "8574829d-48f6-4af8-a0e5-2a75b0b7a8d5", "comment": "Malware payload (a310Logger)", "value": "ad506691803e24add7ac4c1ead5d22752930f23f83443f18ab73fea3db7719caca43f5e981ea2984219c4b45f7c323ef", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296114, "uuid": "000e8c4d-abbf-489a-a5d3-3d4aa89c7f36", "value": "T13864480817F88A65F5BE9BBEC0B551608371B462B83FDB4E1EC560EA2D32350CD49B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296114, "uuid": "95e77771-c57f-4d31-bb50-5219268a9092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296114, "uuid": "c41bde62-ad0e-4f79-a66c-38746787b1cf", "value": "6144:HHXT6MDdbICydeBaWRHMmzKjpIo3+wBmA1D0aU9:HHNTMmzKNIouA1Du9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296114, "uuid": "5bd8e79c-b4a5-43f0-bb5d-54c95c4cea90", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296114, "uuid": "212289d9-20f4-4d79-a4dc-bc4f6eb3b8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296114, "uuid": "c61fcc49-57b8-45bf-a9e5-e099b69a293f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55828590-d4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765272471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272471, "uuid": "fa2e7810-d7e1-4165-865a-f7a51b417a7c", "comment": "Malware payload (Formbook)", "value": "75b0e7b9087968658ec613d2389cd73a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272471, "uuid": "100d5f3c-1f4b-4d81-813c-a281e27effd2", "comment": "Malware payload (Formbook)", "value": "e2b4042826e99d55fdf40f578cb9893c20c1295aff36abb1065bcaf25147e3be", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272471, "uuid": "6157629f-3085-427d-b14c-1002ea724328", "comment": "Malware payload (Formbook)", "value": "aea6a50ffa9d0d55bed67532eaa976933a5baa1e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272471, "uuid": "dea71dcf-59c0-4132-8bd7-c6dbe422e557", "comment": "Malware payload (Formbook)", "value": "7002c373e4c019f2aa5278f9c7dca2ef77d54c6f955545e3c3299cb51d163bd5766ce2135a3acd205af1058e9518573c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272471, "uuid": "cfac5433-d85e-4f3d-978b-5205f2db705c", "value": "T1CC513C80F4C4ACB2DEA80AB11BE7B4845C5951222C311996BAC9F770BFB1C2AB8046E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272471, "uuid": "02c92c1b-ea51-4013-b798-14a0dbd4bb95", "value": "96:jNSSQBnejmZUUMdJy+3/JJsUCYH9eFc+g:jkpZeiZWTyCjaYH9aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272471, "uuid": "096fc76c-6870-41d5-a9dc-246f162a20d9", "value": 3128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272471, "uuid": "bbc8db45-9fe8-4562-9be4-c2d30b42dbd1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272471, "uuid": "0d64cd5e-48c6-45a9-b298-60b98e59735a", "value": "PO PUR-2504003.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287aab31-d51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765299024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299024, "uuid": "8e5fadb3-0805-49aa-b33e-e5bb5c9e68af", "comment": "Malware payload (Mirai)", "value": "b6f4d4974b9a949317a3ed10b09716ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299024, "uuid": "a3e78bb5-61b4-4492-a78a-419a8d50469f", "comment": "Malware payload (Mirai)", "value": "e2bb88625c9d26cd0cd5ab5753e5cc43b85660c44ed37ae713aef723af8033a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299024, "uuid": "86a27097-1ae2-452a-a035-bdb25c475a3c", "comment": "Malware payload (Mirai)", "value": "06f5b0eb30372ccec7e400031979ad94ee5b735d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765299024, "uuid": "12f776a6-74cb-4f53-9a69-bf0a0888e5cb", "comment": "Malware payload (Mirai)", "value": "0e1bbd03f6fc062933be4038af42e609a9e8b133e2aee2cb7ca5f4c1b3edd64a92ea12ea19eec68b633db4caa11cf85e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299024, "uuid": "16560546-19d8-44e5-8f23-a3551b1cea55", "value": "T1D5635C23797E5D1BC5C4A43A21E74330F1E6770A26E8CA6E7D720E4EFF215446107AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299024, "uuid": "c0953d0d-1a1a-4afc-9dc7-8e741996a373", "value": "1536:pnKTSfyD/m2pEgDI+AZexzVWc00Hz+W0gm+nf7zH7Lhv:pKmm/pHY8gLBr+nf7zHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765299024, "uuid": "862cdef9-9880-4790-8a83-f4f5b790630d", "value": 69584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765299024, "uuid": "b27a25a8-7100-4e80-8da2-030dd2f4f722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765299024, "uuid": "ca62dbaa-cc21-4bd7-bbbf-eb6e4d28474e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee585ade-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765286471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286471, "uuid": "bcdc0431-58b0-4789-9bf1-2510ffd96093", "comment": "Malware payload (MassLogger)", "value": "110963525bd309ebbef1558e37c16290", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286471, "uuid": "aaa0fae1-0093-47c9-b3d1-625ee5db98ca", "comment": "Malware payload (MassLogger)", "value": "e361684fd6eff05c1cdc9723924a6a3dc68a9429a031a8066d7ac29d71893b36", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286471, "uuid": "c24737ce-56c6-42dd-89e2-69499b7a6b6e", "comment": "Malware payload (MassLogger)", "value": "f85e31c331eb7fe891e5d7232c0301d24c82f672", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286471, "uuid": "52c82175-6ed1-4042-9dce-7084a500c691", "comment": "Malware payload (MassLogger)", "value": "bbf453fc5c19d9ada3038f31eaf023a694f96e6ff6f21ac3fc39f947f670ec6622c34300832688b4c64731419e10ae5a", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286471, "uuid": "095277d4-fd11-412f-84d6-e68e1e2a2c18", "value": "T1C355E49D4461ADD3A054FEF0F540EF978CDB5394122B47121FE5A9AD2212883FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286471, "uuid": "92c0abf9-50bf-4496-b603-4fdd25f5e2a1", "value": "24576:XFzqATZP3t7fqp8Ma4lLyyzVfqt6i4effEiE6jrkU/:DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286471, "uuid": "b76b2eb6-3788-42c3-9297-f8205f11911f", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286471, "uuid": "0a074c9f-4c9d-4c95-8f4c-f5b9bb97f336", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286471, "uuid": "19dc60ce-6c8e-456e-9971-c44d7ff5ca73", "value": "mmbi889542025.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676d47a7-d50b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765290540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290540, "uuid": "cb1e0d54-5915-49b6-8471-77c1040ce4f0", "comment": "Malware payload", "value": "2f61b5fd57db526290e1733225c2ae00", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290540, "uuid": "57423b9d-39a5-4385-8b2c-c39d57286759", "comment": "Malware payload", "value": "e5b2da3e95d97cff98f325c93a45983fe21ebbe2c0a51cff8c7883302a1e63f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290540, "uuid": "0cc1e2d3-388a-4eb0-86b4-40e1ba0fcdf9", "comment": "Malware payload", "value": "81c334bc625cb535040eda8e6b3241e47440ff2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765290540, "uuid": "5bf49cc0-6265-4c8e-8dbd-e8652cd88245", "comment": "Malware payload", "value": "e985da3c005bc962e4ce9554c39a475b4762f38fe4ead628493adfcda07c9b23100a26e3a4529d2f61e69704afa5721a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290540, "uuid": "c08fc271-5da6-46f9-bcf8-fc8812ff3073", "value": "T1F8F0E9A2B52115317618778EB549429524439D372CCA7C4474AEE4202B4E3D4A5D4F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290540, "uuid": "447cbe7f-5d67-417a-800c-f17084b98e35", "value": "12:oLWuGHEG3F4HJy6vwvBSRifulDQc9udOQP0y0:odQEG3OHJJwElDHI4A0y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765290540, "uuid": "a09c04f2-eeee-4a32-8518-7914c740aac1", "value": 522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765290540, "uuid": "0ebe6704-65b1-4418-a0a5-30e7b3a8dc17", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765290540, "uuid": "bc8c1a52-f582-49b2-8aa0-ea65b6c449e0", "value": "lmao.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf1ba39-d544-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765315217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315217, "uuid": "b784abd0-619a-4da4-a0d7-cf24f3eed748", "comment": "Malware payload", "value": "6c0b87153a1b9083a77a848fdebeb4df", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315217, "uuid": "e69b6a05-8103-4fd8-9b00-db69dca7b74d", "comment": "Malware payload", "value": "e5fae433d3965683a2ae5873781e001a9ecd77b69d996223f80ec0e709420631", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315217, "uuid": "2e0a87fe-82a6-42cc-bf97-c369899102c6", "comment": "Malware payload", "value": "de0f7b2d6aa027c8393d61df2aa33e4962a61e61", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765315217, "uuid": "ed459738-ea90-4f09-ae31-0baf00cfd2a4", "comment": "Malware payload", "value": "e47cc31dccbee80d89987c5e498f40a8ce44dc5c1a09c7b6ac7d813070625e879ac57720d0a7639019aa91f21e051854", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315217, "uuid": "4f616ea3-4d52-4b4e-84da-af35cdc7a8b1", "value": "T10AC2E077E2C1F76A4E1CF236B2736648DC6F08175407A8C6B95AE056076B909DC08C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315217, "uuid": "ec3ba9f2-4fab-4862-aa7e-705309ea8c8c", "value": "384:KmuN7bbSF+FSK2tE9cF7aS8tfs00WjYIzATqM4WTbGBz7GoGbnvG9X2yerunSgT+:Y4MwB6cF2Jtfs00WjX8Tl/ud2yAYzqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765315217, "uuid": "2355fd1b-9b86-4a27-a186-e5c7b07c08c1", "value": 25750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765315217, "uuid": "72909e28-7de1-4c9d-bf9b-fe3c7e8a0d3d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765315217, "uuid": "274cc1b7-2655-467a-be50-6ea4aecae3a5", "value": "kryo_crypted_cfv2glvk.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bec19d-d4ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765276411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276411, "uuid": "382bfedf-61e3-4034-a863-6024f37a3be2", "comment": "Malware payload", "value": "c68eb0120cec0b9a549c00dfa4b1f8d7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276411, "uuid": "bf982cce-b348-4581-a066-9484d7968ef5", "comment": "Malware payload", "value": "e66459033a5de3b7b6d9b8aafd104bff69125de727c364c02c3a699676770a89", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276411, "uuid": "3b1e23b1-9748-48dc-a5af-cc1b12dca1c6", "comment": "Malware payload", "value": "55c0c92b0c091b03b8108ce4de51b03c223a5618", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765276411, "uuid": "8b711f68-9b99-41d3-9797-26b820ac6957", "comment": "Malware payload", "value": "42af3f328454df208e9d3f91b1f9bbe7e649859dc5b352379e65d0f28ee96806824cb3ffb306b0728f1bd8a746a7360e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276411, "uuid": "821a7a44-acfa-4e4a-9a43-95e06cf57a0e", "value": "T1259383494DCB84E11B6B74A9461F180BDBBE97030A0DC9D9BE8DAB507F12DE460EDED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276411, "uuid": "db40647b-50aa-4466-bba8-cf2e2a44f089", "value": "1536:ObXBDkvWl4/3IhVZYNy7NQkjD87Injl8LE:0YqY3YZYQQ77Ajl8LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765276411, "uuid": "b534600f-e9ab-4345-8077-af5865ac8ce7", "value": 91719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765276411, "uuid": "d1f7515c-3af6-4eae-86b7-3d460c1ffd2c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765276411, "uuid": "acaf66cf-2ace-49df-b6a1-8f4a4ab1f823", "value": "Quantum_Session_Canada_346.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a7e137-d502-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765286858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286858, "uuid": "eaec35d3-9546-4aff-a1bf-513e59bbd76f", "comment": "Malware payload (XWorm)", "value": "4fb72169423a06661d5fad875e6b7b24", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286858, "uuid": "c7207b9f-30be-4fbc-a9a8-1f0405e4dc17", "comment": "Malware payload (XWorm)", "value": "e66b8fb1b3d9be2489bc14e3c80b694c633ccc074ae851689826bc55cee3619b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286858, "uuid": "7b309e58-879b-4f36-8e1e-757c68715ef3", "comment": "Malware payload (XWorm)", "value": "6d6a6f2f2f6bc6a35042ffa16d4889fe4172755b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286858, "uuid": "50086d46-7153-4220-b5c0-f5d83e18121a", "comment": "Malware payload (XWorm)", "value": "21d28a513b84ab7caf65ca0822714d3e53cacd72865a87cc9e20e39c795903646bc42b9c77e3acd19e5391fd49f57e30", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286858, "uuid": "f88d5207-dae7-49f8-9eb8-1eeef81f965c", "value": "T13B85F86E780422D6D5E373683869897CBDDC049AAFE0C5C3844A7A5B2F57A0D1B7CEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286858, "uuid": "fea250b5-6dd6-42d2-a46e-056c8637c42e", "value": "3072:td6cOgSW03R0ZuRANSEy3u0PlNUmwmVdzGAZYYYULQ:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286858, "uuid": "a0ac08e6-7694-4009-a94c-c0acb85af2e1", "value": 1760848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286858, "uuid": "1946caae-0b94-4ac2-9adf-2eb76f9a30d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286858, "uuid": "bc92ae7f-5b3c-46f0-a3e6-3e5bf94c48a8", "value": "MB266382625AE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219b5ce9-d499-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1765241460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241460, "uuid": "6f46a22b-86cb-47e5-b3b7-d3a5483f954f", "comment": "Malware payload (BlankGrabber)", "value": "6bd9fe79acd2195733924d708d02c5e2", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241460, "uuid": "e450d674-3e8d-45cf-8cf3-7de88630cfcd", "comment": "Malware payload (BlankGrabber)", "value": "e69961df24aed849e852b4e95667e3d94133eccd07e687ccd1aed5e2403a6813", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241460, "uuid": "f5e200a3-f4b7-43d6-b14b-862fb293bde1", "comment": "Malware payload (BlankGrabber)", "value": "65cec22442755c017edbb006635f6dc620c1e467", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765241460, "uuid": "902b9043-9761-4fdb-a1aa-3ac09c9caa7d", "comment": "Malware payload (BlankGrabber)", "value": "9da283da557cde61838eb437d5a942ac39abbef687d9ca9e65b24b69b64949ba994e35f7efde99c7e516a0e187c4a94b", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241460, "uuid": "5be4fd5b-3131-47d4-b820-67352d200086", "value": "T1B815337A4EC03702D5529767F66A9FBFF99C1E1B6F49720C0212D1B44AC336C910E7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241460, "uuid": "1788cc5f-d51b-4ed5-aab4-6b9a393a72f1", "value": "24576:GY2oAQemAMGocvm6qeFQw02dY6rR+04RXjS9APwIAFJZ2hM1kcvBh:GXmCocJIH6dV9APwnFbkMbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765241460, "uuid": "399eaaa7-24bf-44f0-a6c7-ad477f8f1e67", "value": 915664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765241460, "uuid": "b7d37b5d-1e7b-4069-a74c-ce4650faed1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765241460, "uuid": "74530890-2089-49ba-a68c-1b8fd9c18a33", "value": "Blank Grabber.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ada24c-d519-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765296570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296570, "uuid": "de7c059d-d94f-4495-acc9-08d72b623556", "comment": "Malware payload", "value": "8e3caa9ecd29d9d0a89ca1139b453859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296570, "uuid": "c84cabb6-8583-4c52-bc03-ac70a3a02e06", "comment": "Malware payload", "value": "e78e8495504dfbee78dcb54f982e2ad24311b626bd6dcac63de72dae6fd4efb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296570, "uuid": "5621e6d8-efe0-47e9-9716-1f81a8dc1de3", "comment": "Malware payload", "value": "2d601d6bdba23f9ba01f55385ed1b8cdeaec1d6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296570, "uuid": "2ed09d2b-4b8c-4e47-a41c-8e16d07066d6", "comment": "Malware payload", "value": "e11d0075b03392423ef398bd1d916f8c6e64ce2eec21e9345b45d3d39f5a9f0f21853124b3f07053907ec0cb9160c399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296570, "uuid": "34219065-61d5-409b-b1b3-a7f0d0b23bcb", "value": "T17543F885B8918A23C5D862BAFA6E82CD332553F8D1DF3303DD11AF157B8992F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296570, "uuid": "5cf54f69-d6fd-4dc5-b890-c06a35081126", "value": "1536:MqU4Y4Za1N8z4Z2KgqUK7Myp18AdT3bsR:vU4YdHgTKwyp1/dT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296570, "uuid": "50524365-5f36-48af-b3c3-659c8cd9aafe", "value": 60588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296570, "uuid": "a02cae84-4eb8-48dd-aa8b-2653bc8cc700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296570, "uuid": "6666b891-cf8b-4b2b-9b2b-44c06b102bb6", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c833f531-d4d3-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765266651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266651, "uuid": "e95f9870-bd8f-4fef-8aae-16f852a6ed18", "comment": "Malware payload (NetSupport)", "value": "f9687e17b1b752947009ce2d2216bda0", "object_relation": "md5", "Tag": [ { "name": "automarketingsales-com", "colour": "#2FCB45", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266651, "uuid": "5da01658-4a93-4c54-8c60-939f4b7adf83", "comment": "Malware payload (NetSupport)", "value": "e7abc6ad0370830255da7d0e4fc51dca9ef73d99c1c1a9753bc5054a7d87505b", "object_relation": "sha256", "Tag": [ { "name": "automarketingsales-com", "colour": "#2FCB45", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266651, "uuid": "1fd6b3e2-2f27-4368-9b08-17a23753bfec", "comment": "Malware payload (NetSupport)", "value": "dc29e3be9978220d5587356a9353d21a900336be", "object_relation": "sha1", "Tag": [ { "name": "automarketingsales-com", "colour": "#2FCB45", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765266651, "uuid": "98b790d1-e431-4e56-bbcb-7f3c16eee2c0", "comment": "Malware payload (NetSupport)", "value": "d46404374dfea8b3693add4fa29862e64bfd9b6ef13a4540dd64816ea01fb1517a3480723f59c87031a7c50567659ffc", "object_relation": "sha3-384", "Tag": [ { "name": "automarketingsales-com", "colour": "#2FCB45", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266651, "uuid": "9aa972b0-bc07-440a-a657-f12554300f8d", "value": "T13AA2D130AB7CE756D76D06F3B6DA788C8FEC50685680438AE88CFC010A8FA9F115616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266651, "uuid": "9e97a611-d1d4-4b34-8fe9-f56e321826e6", "value": "384:kXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NKR:kXKuqXS69Szi/urdMt5lBUeuhJrsRxLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765266651, "uuid": "a1eb2840-02a8-4cd2-8f21-d2c2367af24d", "value": 22265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765266651, "uuid": "6723aa10-d11e-4c5c-b9db-58ee94389c08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765266651, "uuid": "f203ed8b-ca0b-4eb2-9298-97775b5e6b53", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47655993-d506-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765288339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288339, "uuid": "67f3d290-d2a8-4ebf-89d2-4df64c318d41", "comment": "Malware payload", "value": "7b5c88aa1665c7555cf227e01683b4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288339, "uuid": "04416216-9940-4942-862a-844613f907b6", "comment": "Malware payload", "value": "e7ccc8368fff4db13ebdd7ab3bf4b486145e91b1ad48bb75fceb407f1a2ed3f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288339, "uuid": "a0c2744d-a252-4ad6-a00c-41e4838ea599", "comment": "Malware payload", "value": "3b007fb0a1a25835f7d7279a7f75450e6e76854e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288339, "uuid": "fcde47af-574e-462b-8a83-73282623988c", "comment": "Malware payload", "value": "4afc13ecbf45e907808a375a998a96a48f23aeecee34d908b452f993fad19f575d3d1ccb6f6ec27e9f8218524efe282c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288339, "uuid": "4e78711d-c455-424d-9cab-3fca0b796a1d", "value": "T133087B4263EA04C4F9F7DA759AE65617C673BC122F3095CF220C17291F736E09A76B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288339, "uuid": "881a4f1b-b229-464c-9bc3-99fd620d7df7", "value": "56c2f8c966897cdb64954ebc4c75c126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288339, "uuid": "4611c84d-20c5-42b3-92c9-e9a529801747", "value": "393216:Ytbu6uPZI7nqYAERCJbE81AKlkUiB0uu+sIyNOnS0B4AycWMCYDMbLbTOwEJ7eVS:YYNrgsJYUKY6ShrsxwbveoLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765288339, "uuid": "7cbc35ff-bee9-4d91-ab95-d0b35d1af736", "value": 83249214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765288339, "uuid": "b4d32b05-e865-4a21-8a7c-f21204ec21d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288339, "uuid": "177b7705-65ae-4193-9690-e0da1ce21280", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56ad6bb-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765298080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298080, "uuid": "2a29f3eb-0901-48ca-af66-615cb25809c4", "comment": "Malware payload", "value": "d66685c1ff0ea4e93724b4e86459a8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298080, "uuid": "db63efe8-3375-4b52-a0db-d673d35b1323", "comment": "Malware payload", "value": "e8b13c084533e4ae24ea404d7bd849554af93071e62c61ef47f7f98cd8d62e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298080, "uuid": "f63e84d5-b29f-4375-b63e-d54c8608c082", "comment": "Malware payload", "value": "cf66fff1c1d02e0b19fd8faab55930d0ea499df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298080, "uuid": "0caf2353-5b01-4902-9b9e-59119e05a46e", "comment": "Malware payload", "value": "d8a55615b4225ccf67e64cb60e80a58896de996d24cb69e561015a1822dd5d7a6a6369762e9717a857886625386b0f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298080, "uuid": "68a5564a-c0b6-483c-ade0-2064b1454499", "value": "T112F5234966D18C35CA525D3482300AB443779F993A91F383FDA83CB737B37D968A64CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298080, "uuid": "c2d272fb-b8e7-4e84-ac1f-a9e32d271ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298080, "uuid": "fe61a9ea-31f0-4a17-a7f8-a7b4e5fecf99", "value": "49152:KpEgjRxxyLxdhXNPEY+XY0y0/ALL+jDjVZepRloRjXYe7ynhYMAHJbWWuuqN3ov:SNfELxbSYAoLLCZ3NYeqhYMkbRui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298080, "uuid": "270b00f2-c733-4358-af65-b8b08237ae5b", "value": 3489280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298080, "uuid": "45145fdd-85e0-439f-8e0d-9f9957cdc296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298080, "uuid": "f69220e0-29f5-43f2-a0bb-c998ae362fb6", "value": "z45Transferencia_1292025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e9a6e9-d4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765252391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252391, "uuid": "ea48d454-1475-4c98-9a3f-f9d073bb05d6", "comment": "Malware payload (Mirai)", "value": "55d0ba10bc8583686f828fc7a6779293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252391, "uuid": "50aa0dac-437a-4d62-bb0a-6a544d8329e6", "comment": "Malware payload (Mirai)", "value": "e968653057838538d041a5266ea9280410fb43e0554fda707a82b4a98a2edfab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252391, "uuid": "08f136a1-2232-4808-af10-7ee45b6e39d3", "comment": "Malware payload (Mirai)", "value": "d1d90bc2cd9c30b8cbc3a5fe29a468ad16c3d427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765252391, "uuid": "44b2605f-a458-4aef-9124-4e38fe09c05b", "comment": "Malware payload (Mirai)", "value": "7c623b9f0c0281e1045a9f0655ae6bf52c390c1557b5cbde97fb4ec5b42f7d186ff495bd58b8eb439e8a697a713fc0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252391, "uuid": "31dc4e12-ad5a-46f9-b20c-be473be580f2", "value": "T115D39EBDF86913ECD02F40BB4E0065682C59DFFC17706AECAE456E21CC947315EA6A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252391, "uuid": "84ecbf73-accf-43bc-a7ad-77fbb11d25b8", "value": "3072:Qq7IIDyDT4drkGzdzIkQNHOGE3cZlrYeqVUH8qtNXitz:Qq7IbD8doMKkQxOGCcZlr/q6cqvXip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765252391, "uuid": "9ab61a60-441a-4107-b2b9-27d58d6c184e", "value": 141808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765252391, "uuid": "29dc1410-1134-431f-b8d8-a3884a428418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765252391, "uuid": "63d26f08-afcc-45ec-8af7-4800b82402bc", "value": "csky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9840f0d-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298060, "uuid": "aa4904e5-09a0-47a3-b977-ef327e3aaf9f", "comment": "Malware payload (Mirai)", "value": "79162a0da98269701d911111b26e0586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298060, "uuid": "8836863b-0ec0-404a-b404-852cb29b9998", "comment": "Malware payload (Mirai)", "value": "e97aedec12df098bcaf97646f5ba042b440fbf6dde1a349f12db6bfacdd2c1ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298060, "uuid": "b98dd5b4-f21a-474c-946b-d1b94202d6fc", "comment": "Malware payload (Mirai)", "value": "889d86caf46f3bf84c0f7d73132b376660e59aab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298060, "uuid": "402e4031-32e6-4840-bf2b-09aefedc9dc1", "comment": "Malware payload (Mirai)", "value": "e668b435d97e416c8c68f17126584bd77d704cb21cd69ade96151d5477619e06a6c97807afe994343722335a9cae0d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298060, "uuid": "0389bbcf-727c-4b60-9ae3-ed9b7338bd54", "value": "T12D338DB6C86A9D94C94C12B4A9324AB56F53E000D3562FFB6F49C5B64047AECFA0C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298060, "uuid": "356f9d40-6464-4318-a77a-854e845eebc6", "value": "1536:gaiwt99IxtguTic6xCnJxxSOG27BUm14EeCx1T3bsR/:gtHxNCmTS4CmeEe0T36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298060, "uuid": "84319a30-48ea-4ce8-b458-469be2df8b22", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298060, "uuid": "25167d9d-e07f-4770-82f5-82ae48850ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298060, "uuid": "0a57fd12-0742-4454-a09f-db7b2b7b8570", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57f788b-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765286483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286483, "uuid": "54838c25-b3db-4170-8349-7b99d9766ebc", "comment": "Malware payload (MassLogger)", "value": "9e8f5f573c3ab6cc2b8e095384bbb677", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286483, "uuid": "7077427f-3803-4d83-be2b-43e0bcd00d00", "comment": "Malware payload (MassLogger)", "value": "e9f9c91e6005867102c1395f5849d5105ec0bcb09fe4121f349a9dec5284883e", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286483, "uuid": "732f21e1-af9c-4453-b968-465f3efc09e6", "comment": "Malware payload (MassLogger)", "value": "ba64b555414972cc0a5dfb0153e96ee03af76df8", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286483, "uuid": "9fed7d3b-e7d9-4f7c-a4f3-79bc552e2b53", "comment": "Malware payload (MassLogger)", "value": "c0e35fd969cdb935518fbd70eb94e2a2c3f872bd3a8c68b2081648317c51d8ebce58ac391a76fb6474104c577bcb1fc7", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286483, "uuid": "c687ed39-9472-4e0a-ab89-52cf778b73ad", "value": "T16955F25D4061ADC2A004FDF0F541AFA7CCDB5398122786121FE568AD6322D83FFAB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286483, "uuid": "99b43704-4c93-40ee-b960-82a0d4a36c67", "value": "24576:rA1r+a0BlUTfaNUF1gNMCzObMKaNO0F24W3qecgpebEXR5i:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286483, "uuid": "7c1dcf4e-e24e-4bbd-bd66-931ec5da2f34", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286483, "uuid": "d56526d0-aab5-4a91-b996-3d7439a989a9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286483, "uuid": "2006971b-4e0c-431f-88a2-17911c225bd0", "value": "lig66543.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec192272-d501-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765286468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286468, "uuid": "77351752-c8c0-4b39-9361-926d80fda966", "comment": "Malware payload", "value": "39bd1d393e4528ace209c373b3d90ece", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286468, "uuid": "b80362a2-011a-4fbb-8e23-200d8c08fac6", "comment": "Malware payload", "value": "eac21e0622be039b0af42f238684b72e9a50f595d0caa352421a066043d3e070", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286468, "uuid": "4bf2295b-b4d6-44bc-8f59-527729b9cca8", "comment": "Malware payload", "value": "86b77c88cc15d19b3d738fd78733b5154a296bea", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286468, "uuid": "c91dd3fb-2d82-42f8-8338-4f1f2586ae7c", "comment": "Malware payload", "value": "4de300b0735af616a7de41008edefa7cdfa2eee3084271244bdb5864d9d37c9a06ed35b90f7ce17355efcb008cbc257f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286468, "uuid": "84c630ec-7bcf-4036-aa89-186bb337d7f8", "value": "T1E68633715AA43D3B02A0071AB01E3B375E7E9CAB854DE199F5CCF14B30DA6D2897F864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286468, "uuid": "a611ae4d-312e-4d9b-8f45-9e3d5101724f", "value": "49152:KAuzp0P7W84UF+P1eE6flK8CK/3jZ8ADTm4862w1lbCWPq0a5qSKe6bfrzLPxWbI:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286468, "uuid": "1b16c107-7d41-417d-9d52-1ec8ea75652d", "value": 8551848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286468, "uuid": "91fe015c-7b2c-4189-8c68-9c258724e6d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286468, "uuid": "58c5e076-1e3f-4da9-ba08-69149f9f2f2a", "value": "690663_Ob-ser-var_1889CQ5AQT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8373e8-d542-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765314147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314147, "uuid": "33756e88-198d-4da4-8f20-babaa34c7190", "comment": "Malware payload", "value": "a4b5cf2714cc91fef43b7fdab154b1fd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314147, "uuid": "41a04706-d343-49d0-b3bc-80bfe2154515", "comment": "Malware payload", "value": "eb5e6139b153a72065674ea76078f5b62f4a8bb2f90a3749ee730a1b486eaa13", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314147, "uuid": "f2526edd-6e08-4630-936e-5f586734d663", "comment": "Malware payload", "value": "4d100f5fbd4492331cb8794d319d341d8a688ec9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765314147, "uuid": "b89c05ce-4c7c-4a08-b09c-b142ad2ed85a", "comment": "Malware payload", "value": "0675dac9078cf3f42c2d7d221ca7de6516a8c38a7590262d122283a46075e43ee565944ee1df63dcd83e19c6e16684f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314147, "uuid": "759083f7-a5cd-4819-ab4d-5edd7f241fc6", "value": "T1A9C5E11AA3A401FCD1A7C2B5CD565907DBB2B84A0670A79F06E04F9A2F237715E7E313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314147, "uuid": "75dffb43-0336-4ec7-b95c-fa0fa942f819", "value": "919350504531202eeca84154d8bfdf0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314147, "uuid": "90e8bb52-8183-4c93-b6b4-ec3761a39ce0", "value": "49152:V/onnd5+yqHm/6xc6F6/bRcqYWXB8Y8UbesLfE/Pv:VAnd50G/YcIEnXB865q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765314147, "uuid": "40f6d5ae-b39d-4317-a298-5f591fb6d1ca", "value": 2506240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765314147, "uuid": "ccb4626e-2733-4971-ae16-1df96d40c525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765314147, "uuid": "5e343ab9-f779-4e33-9943-c98ce0e03ace", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0506854-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765248115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248115, "uuid": "75b143ec-149e-49f7-b371-65ac767cc01a", "comment": "Malware payload (Gafgyt)", "value": "d7d62fba2552dce4a51ec406fa405b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248115, "uuid": "cda172e7-4a1e-4975-8db4-73da82a4f188", "comment": "Malware payload (Gafgyt)", "value": "ebee38f02beecf097992c4ea94e6b3dcf860349c4ba6b336bdc9c34f9dce7fd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248115, "uuid": "d2c9d568-7077-4c14-a184-3f24e5bfe02c", "comment": "Malware payload (Gafgyt)", "value": "9c43040d5ba5dc33336a112bc5eb2623af6faf72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248115, "uuid": "59c1cb73-52d9-4015-882b-63d5cc19e6b3", "comment": "Malware payload (Gafgyt)", "value": "ab6c0452c09ba4e222ef8aa4d9bd77318e10a0bee9028db8ce250284f3c96064d5bd804c346b40c13695c196f4b3161a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248115, "uuid": "1a7b0b9d-d09f-4472-8ccd-ccd8730e89b6", "value": "T13604B847A412DF1BD49F673A16930221F6F9E3DD694302336327B8926F634E159BAEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248115, "uuid": "fa9568a8-004d-473d-bded-fbb9c7d0e768", "value": "3072:TZXJtLegXLnhZXHQgLBv52P13AywiM3OlV7wUQTmPs0ao8UtKFX:TZXbZXwgLBv5nywtelqUQTmPs0ao8Uta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248115, "uuid": "72c553e6-7a24-4b04-8861-491fdab21e01", "value": 176549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248115, "uuid": "8cdf0c30-0e6f-4c02-92d1-6bd007f2044e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248115, "uuid": "8cffa7a7-e191-4f7d-86c2-27c45b94175b", "value": "Demon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80743e9e-d4b4-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765253216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765253216, "uuid": "cb671123-0091-45b3-a7a2-e956448bb3e3", "comment": "Malware payload (SnakeKeylogger)", "value": "561a4f7a811b6be30ccde4e33acba606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765253216, "uuid": "e57e5f26-a155-46d1-a2fa-d04e747cf30f", "comment": "Malware payload (SnakeKeylogger)", "value": "ec595bacfb1aede541f76c88ef83d2d43aab06d7379ab78841c2d8740358543a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765253216, "uuid": "f90a268d-fa5a-49f2-9030-4135e4655a2c", "comment": "Malware payload (SnakeKeylogger)", "value": "66986d9f03033b4410c74babdde12943068cf475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765253216, "uuid": "aa95665a-8e7d-405d-899f-d723daebf35a", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ac119c13b080cb5f372e3b8a8c19ded33438c7afc8373c6a546171b02928f3d3a1251db09476ab80567dc1825e978b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765253216, "uuid": "55a63e10-30e0-4727-aa3b-ff76018ddf9f", "value": "T1CDC4CFD43A31B31ECE628831D568ECB591A12C79B106BAE354DF3B5B794C152DE0CFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765253216, "uuid": "d86afec1-c449-49c6-bc88-3cf639f19699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765253216, "uuid": "3427bfff-7010-498a-8152-f50728fea77d", "value": "12288:F0rlZ0TF8SOUwtEIdrQTdo7pzLqgGzuOIINnmAZarrVhWxdDP:qrlZ0KSOUnIWTd09qriOIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765253216, "uuid": "70135ac6-fdd9-4ef5-a4d4-6a36247925a5", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765253216, "uuid": "fe974203-d87e-4668-bd30-ae151ab007d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765253216, "uuid": "139fb8aa-aea3-4b37-b6da-4e228c25120a", "value": "MV SEA GLORY VESSEL INFORMATION..bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31b4826-d558-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765323765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323765, "uuid": "775712af-b33b-475a-b7b3-80916fd8fd6c", "comment": "Malware payload (Mirai)", "value": "a0eda7d43b5dfc5344b90de1393d05ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323765, "uuid": "c168cc13-1c7b-42ba-bec2-dcbf6281971a", "comment": "Malware payload (Mirai)", "value": "ec8759156a06ce7f0a0a26475a924a781ce155ed9ae773d189eb96bc61b57724", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323765, "uuid": "384d937c-b222-4025-ac41-c1207d5b0e03", "comment": "Malware payload (Mirai)", "value": "a30532f3d6e1bc4a32e36ed445ccbb8c7cf684bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765323765, "uuid": "398dad77-fae6-44de-bb30-e11f7a72743e", "comment": "Malware payload (Mirai)", "value": "b2a4aeff8e43c8a7a6a5b570bf3894d05a039b97531c71a12cafb9a8b1ff5130186aa979a743a617f3f7b3e874bf9278", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323765, "uuid": "9245e1b9-cc5d-4f14-9db4-a536fc8fba60", "value": "T13571A4CF029537389C6A4FAA36776098F098B0D186CB9E4DF79F26AD404DECC65015FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323765, "uuid": "eb630411-8f4e-4d97-aadb-b331e9ac7dca", "value": "96:iShtSFESE6voDSzXgbSSMiHQrSqQl3a9S2Ut2JS3zsfGSl5OZISmk9mVLS5F6d8m:fhtSFdE6voWzXgbPMiHQOqQJaM2Ut2Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765323765, "uuid": "60b1cd3b-4f5e-4323-8b0d-77b40ff11087", "value": 3644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765323765, "uuid": "26b669d7-f102-4869-b8dc-bcc6b5bd7425", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765323765, "uuid": "2ec0dca8-cbb8-4433-a659-488cd0295d92", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cb6090-d527-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302731, "uuid": "5edcb249-529f-4ff9-b04f-f25278eb3080", "comment": "Malware payload (Mirai)", "value": "294f45b6b2064ed76f7f8c0a07e22a70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302731, "uuid": "22eab505-5aeb-4f81-bba3-0960884820f5", "comment": "Malware payload (Mirai)", "value": "ee2a0a3d5f718647ad913f88a5b2ac6f952bb0c2654c851c647fdef0381154bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302731, "uuid": "cc3cefb3-4ffa-4fc9-a638-94f501747095", "comment": "Malware payload (Mirai)", "value": "3e1596dd3d901dda9ef92bfb99aa73d5916896a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302731, "uuid": "26d63ce3-2938-4770-9d1d-a398882ba1cb", "comment": "Malware payload (Mirai)", "value": "f9681479f1259a753c08c19a9336b5dc01ee2b150b22fa20a45f8b4f4511c92366b4689b801d78eafd8d7b32eca6cc25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302731, "uuid": "f99741c2-9e58-4174-82eb-f096cf8178d1", "value": "T13F659E56F2B370BDC017C03087ABCB625935F47511326D7B36C4A6382DA2EA05F2AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302731, "uuid": "ec734856-e971-4732-9367-9e1dc2b85c7e", "value": "24576:Z3f6DNSgDhj5x0nmp4iG4dBAT+jnLrZ+6HUUU2sOXAXN52F5:xfgSgDhj5x0mp4iGwAT+jvM6rXwXNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302731, "uuid": "52498777-e0b1-4a7f-a6ba-fb7c0289040a", "value": 1481096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302731, "uuid": "e4cae303-1058-4969-a260-aaa3d1a9b225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302731, "uuid": "d1d4f1ed-f738-4fbb-8c4e-ed51fe078a5d", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01eafcf-d518-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765296272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296272, "uuid": "328799e7-60b8-42c8-86a0-2ca2d64bd2ad", "comment": "Malware payload", "value": "378ee13041736c3afe8bc1811be390ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296272, "uuid": "96ad9fd3-7910-40db-984f-f880a7db8c1d", "comment": "Malware payload", "value": "ef47cc1b8d27320cd1b032a43131c77728cc49b00446d3c747db0de224429429", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296272, "uuid": "c579b06e-724a-4862-baaa-91b5d6b86739", "comment": "Malware payload", "value": "5e2690aa8a3c66ef384eb568e1abc31b04264c1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296272, "uuid": "1f7ebd8c-6d9a-423f-9fbc-09383a18def0", "comment": "Malware payload", "value": "0f388551d25bd1283f8a6f7587bf66d11a94c0fddbab1c84b299f9d502ae599d5882778efd2f46d577c5793fdd9bf2cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296272, "uuid": "93096c5a-af7a-4913-98af-e45098c42663", "value": "T18C32298CAEA13070F21703DD3BBF65591229E0D7244CC994F74DAEE8AF4738D8646E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296272, "uuid": "e08c5fed-4f35-4079-9699-27c0d119e618", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzlqHtd9wDsIPQjrSjp:sXX+/DV7k/3lqHtd9wDsIoKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296272, "uuid": "f1ecf475-62f0-4cac-9dc1-8b8844c6b600", "value": 11874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296272, "uuid": "6dcc3c9b-bf6b-470a-9b92-35dace2a3363", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296272, "uuid": "d6941b27-b063-4082-9444-5e42d50b1d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125736da-d4ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765285243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285243, "uuid": "63334b21-1177-433e-bbe2-fdb80a6c4369", "comment": "Malware payload", "value": "5d2bb3cd60e97577806fa96fa34fb4ce", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285243, "uuid": "7d4c7583-bcfc-41d0-ac9a-2bd3bb6498d9", "comment": "Malware payload", "value": "f1b439e23f0bd7ab251987a7e48b93c54fc71b69ba7cd744c51682daaddf29da", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285243, "uuid": "4c141b1d-f41b-45d1-8fc6-e5a68007deab", "comment": "Malware payload", "value": "8c3b9deb3c368d550cfab46776809180b0d4e373", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765285243, "uuid": "bcf7c178-c015-4f43-af9d-6c291ba84977", "comment": "Malware payload", "value": "f0a14f13b4c70a2b1d29a32dc8b4e716469805a3ec9f9d2557826761da023839fac788143ab578ac4aeb99296f14f51d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285243, "uuid": "cb3cfd2d-55f8-4bf9-82d0-9c70cf29ff8e", "value": "T163E512BB94B2A9536A904563FA0F2C1A335B19E53B64E341E94150AC7F770D38F92B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285243, "uuid": "1890ba60-0238-45e4-bbe3-9ca0613be821", "value": "49152:qOc2yD4lTPRU63uakjq4cPfVs+xIRt7LKPsNdQzIsGWokM5C7EpZ+jd:qoyEFP2Ljp4fVn+dLKsNuksGhkM5CMZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765285243, "uuid": "551d9924-3245-4cc9-b09b-94727bfc6d89", "value": 3059016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765285243, "uuid": "0141b7ca-173a-4926-900d-0d263fd18be1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765285243, "uuid": "9cafc150-dfe8-4571-b301-ec2333ccf992", "value": "REM 2526 B101.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda746b2-d4d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765268807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268807, "uuid": "cfa5420a-4be7-4eff-905a-92c35c77e4b1", "comment": "Malware payload", "value": "1528a964a21df0dd3e59156cc8ec95d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268807, "uuid": "e4aba7e0-4965-4cc2-b83e-6fdbb92d4262", "comment": "Malware payload", "value": "f21896c306f3ea69ebe12428dd3489ed5784b08a049de8c6d3363e4d2770ecac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268807, "uuid": "d1268553-cfc5-4aed-a4ef-906b0217745e", "comment": "Malware payload", "value": "ad03f2b372465c26ccf6f09e2dafb4cadb79fc9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765268807, "uuid": "3418cf90-ac1d-459f-a954-93c1649d5856", "comment": "Malware payload", "value": "c5e0b2c759941d0a0549423ff596e982c514f42c693fa90e383ae83a80c0bcacd45e4dcd28b2afb5b02635efbd73511c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268807, "uuid": "73bc6582-fa5e-4308-a2ab-7f9353778777", "value": "T18956037ADB7E0E31D76205F24F2E6658B40FAA4C9C1A4E0D3B10D5C4EFAF5E848B5A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268807, "uuid": "56c68802-36e3-42cb-ba02-ca444871610c", "value": "96:NaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaG:Ul++w7Jie6OVFiKImW/FRYaD6XAt/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765268807, "uuid": "34fcd8f5-eae1-4939-9f8f-0fabfa6c9a32", "value": 6404683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765268807, "uuid": "0d5b2ab6-a361-4a19-b935-a299867dab72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765268807, "uuid": "ac5ceed4-2d44-4e86-835d-9cd21f1e13bb", "value": "R-4651-ABADAN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe1b683-d4ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765264409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264409, "uuid": "02d930c3-1420-40d9-a1fe-d751d838bfc5", "comment": "Malware payload", "value": "5eff7c895d81cf322bd2f69ff0e00ee1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264409, "uuid": "e9ef0e55-2080-4c01-a210-5cdeaa307ed9", "comment": "Malware payload", "value": "f28d8b1301e83a88a9fa40415ed613e60485e219350ea1b9a2cf7e264b043738", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264409, "uuid": "fe115ba2-9c67-4a67-93ef-b5303b8000f8", "comment": "Malware payload", "value": "126dd868e3e4cd44ca1d60e7750cf63c8af5a27d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765264409, "uuid": "e0915bbd-f0a8-4c93-8c47-79b7e5c39973", "comment": "Malware payload", "value": "bd8665436f71467ccfa8ad0359cb9811b5f837078095492529e6a5b881c8afa09a5c5806996bb44dd26547816c0db23c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264409, "uuid": "0e72bdd3-46c2-464f-b8d7-a48f83dc536d", "value": "T107E5D09AF758572FC877403349EA663222974D178A839B876848361C39776F80F9DFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264409, "uuid": "bdb2cda5-6915-4090-9204-5cb5c5048cca", "value": "49152:3Xu1TLjW63p0JyPA4ho1B1AxsHAJ6lFuYR40AfrBzHgh4vIvCgWxNd2ofrApfx:nu1bW9JIarOeAJIuE49rVGyrd2ofrAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765264409, "uuid": "a7f0a0d9-8aea-4fd5-a494-d5fece275769", "value": 3142632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765264409, "uuid": "d19d2902-70a8-4788-96c0-85c86dbd1802", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765264409, "uuid": "0c4fe479-c408-4237-9018-e53d1b8304f3", "value": "1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d83611-d4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765284956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284956, "uuid": "3ab7ebd8-6fa9-40ae-a795-bd961ec87a23", "comment": "Malware payload (AgentTesla)", "value": "b8368f2072ee7361e08dabe6e1d06120", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284956, "uuid": "4f691e12-dd83-4c34-b53d-0d23e2e599a3", "comment": "Malware payload (AgentTesla)", "value": "f29dbd61079b6c110754a9f354407ff8576cc7f2e267878b688bf340272f6b7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284956, "uuid": "8e0f6db4-cd5d-4cfa-8630-d50f08e84eb4", "comment": "Malware payload (AgentTesla)", "value": "f3c24baf0ecc64dbf3228fb99dd20306131d03bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765284956, "uuid": "dca5b90d-c2b7-49f2-b77c-0933642496af", "comment": "Malware payload (AgentTesla)", "value": "d233873f963ae81312f850e6af974604f2b906548f016beca2e7335a3e5edd09fe3b9a83cce33dcc202d036f56843db2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284956, "uuid": "7e2e36a7-652c-42e3-b026-ce8bdeab3250", "value": "T14CC42328740CA5D86A14E14A7480D4B51F96D73FE6EED88FA702FE334EE73D0A245399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284956, "uuid": "0ca28070-e7fb-4f46-ac1e-53d724cf38e7", "value": "12288:E0T6ufgmxwB1C0937cNMSMcgk7ki7DnuSUB4SwH94y05IPIE:Eijxw+y7cSSwk7kEDuSAw2yG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765284956, "uuid": "8c8705ed-aa8e-4f53-aa12-d367c8f35015", "value": 587138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765284956, "uuid": "1f0912be-af31-4aaf-8cdf-a9b73b86634b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765284956, "uuid": "ff10b884-c73c-40a8-91ab-a5fc591df781", "value": "PONOV121125.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f360c2a9-d4ee-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectBack)", "timestamp": 1765278319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278319, "uuid": "0ce4f00b-3a5b-4e3f-9cc4-7f6bd3408c4a", "comment": "Malware payload (ConnectBack)", "value": "657e355374203d2f5e406f951fc7d5ce", "object_relation": "md5", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278319, "uuid": "205a2d44-a059-4440-b687-693e017806b6", "comment": "Malware payload (ConnectBack)", "value": "f399970f11d225af0649ab5d5e29e250a3f702ad5653fcf8b6cc4b2408f255cc", "object_relation": "sha256", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278319, "uuid": "8ce7c3f3-e138-4047-98b9-45c43e327a92", "comment": "Malware payload (ConnectBack)", "value": "edf451f278e1d6659bf24b7035c087d7b8896680", "object_relation": "sha1", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765278319, "uuid": "235189d3-b535-43d7-874a-468a73e2d386", "comment": "Malware payload (ConnectBack)", "value": "176dca78852e4f219e9d27e3b80ec9280bb5151ab1eced367ff5e6dfa348a12cb4cec98ee1ae230657b535a5ab248859", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278319, "uuid": "efe40b6b-28ae-4278-af74-249b834e6bc1", "value": "T1D7812B3B47498053CDA4033EE4AD042CB3BDD8516707B3131281AA222C06648EE5287A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278319, "uuid": "0d4b9621-ecad-45ff-863e-df91fe59bbee", "value": "6:BnX//Zt8//I1dXUU4SUQh0o//+sY6VLBxHocmTx9Q3RQdygg5XJY:Bv780UUbU40oXHBVfH3ms532", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765278319, "uuid": "6948454b-e491-4a18-813d-e31aaf3101a0", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765278319, "uuid": "4d8d9845-9678-4b95-9e85-fdd7eae257f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765278319, "uuid": "778eefce-d572-4f38-a780-b1ee84135550", "value": "sshd.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99b9cee-d52c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765304851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304851, "uuid": "6ebca31d-9c5c-404e-b766-30b8f01422b9", "comment": "Malware payload (Mirai)", "value": "aa2bc94af58100c4a8fc83a778b92a70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304851, "uuid": "dc03d2d9-2885-46e9-8fdd-ee0da45bbc5a", "comment": "Malware payload (Mirai)", "value": "f3d9863bb567df53e1b05d12ce23e6ee02e218af943ba0dec9a300bbca79823f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304851, "uuid": "94cda8c6-51e4-499a-a272-e3e3c3733959", "comment": "Malware payload (Mirai)", "value": "028b50eb26c9af4111767373d8383d9b65712837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765304851, "uuid": "7e0da854-8d87-4167-999e-61cfcbee544a", "comment": "Malware payload (Mirai)", "value": "fc4e20a27a5beb3d83d7dc93e5ddc0cccfc1b3fa3653252a01ea4d303d89dd7e1989d02d74e01073471a29aaaf3ffca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304851, "uuid": "e9f279b1-5529-4487-8661-535301441a5a", "value": "T1CB433BC69400CD3CFA4AEABBC8174E09F528331556521F27DA6AFE935C721958E1FEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304851, "uuid": "7f7ec30a-0754-47b6-a2a3-0d27f7be9823", "value": "1536:It0R+N2uH42EVDsSj0HsssssxMu178uOZxkgAMTpd2843yP/:It0R+NC2E+S4HsssssxM6oPPT32J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765304851, "uuid": "08bae5fd-aa8d-4b23-92de-574a52854fa0", "value": 60104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765304851, "uuid": "19163af0-a13a-4cd3-9f38-0338e13a43b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765304851, "uuid": "dba66fac-4931-4f54-a638-58aa53ef38e9", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f41ba55-d523-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765300915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300915, "uuid": "1beb1ba4-7dc1-42b7-a9f3-7e2793f998d6", "comment": "Malware payload (Mirai)", "value": "4773b6bf75570c0d52f4f00cfdabbda1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300915, "uuid": "d2a3cf18-87f7-4ab0-9902-e992775556e3", "comment": "Malware payload (Mirai)", "value": "f437627016f460cc7438ecb37c9b3eddbc4050859fe3a98565b31f7ed4fae0f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300915, "uuid": "96ce0c57-2efa-4cf5-8fcd-aaf9a6975331", "comment": "Malware payload (Mirai)", "value": "0042b063317affb0f1193b2a721eff24c726f114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765300915, "uuid": "f62bce96-a789-4f23-92bb-34a6d8e1e346", "comment": "Malware payload (Mirai)", "value": "94cd69ec878e4f3e6bedee51434ae9669bbc79e92fbb8f07728ef7bb52eb8b545d8cc7a7f8eb08898014c9b650828fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300915, "uuid": "dcb75c13-33bf-4d3e-8c62-3e7a4af4e661", "value": "T12843D646B981DB55C9C595BAFE0E529D331307B8E3EF73039914AB247B8B47B0E3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300915, "uuid": "b91147d4-e539-41ea-a3d0-6cb8de3f719b", "value": "1536:XBnl2OTuJvqnyMW6SiNT16XVflhKF32MiiK4NipbW5T3bsRed:XtTuJycup6F74NipbW5T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765300915, "uuid": "0a6d83a0-0185-4751-9ab6-81f3574d8f09", "value": 55484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765300915, "uuid": "c342eb53-8912-439c-8cce-bdaf6bf4ec59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765300915, "uuid": "d6bd2cdb-f91f-41a2-962a-820d71f80078", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a337a526-d4a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765248120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248120, "uuid": "2192bb3b-ab1d-469a-9b34-2948750df6f9", "comment": "Malware payload (Mirai)", "value": "998b04bf09653e349475b21d8337fbe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248120, "uuid": "fc63e216-3384-46e9-857b-cf9c336bb5c2", "comment": "Malware payload (Mirai)", "value": "f60e4dfdc819a1ff12064faabbfd14a1ddf90ff5af5d9098718e5e611f0c8066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248120, "uuid": "8459fc2c-c77b-4d87-8436-bdc4de702b63", "comment": "Malware payload (Mirai)", "value": "489eb199f06ada39139ccc7be9c96a4e62755160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765248120, "uuid": "4f8c74d9-9249-4b0a-9fcf-3604033fc714", "comment": "Malware payload (Mirai)", "value": "fa7f2d299c0aeac63c5a4faeaab4e9b6bac8e0720769cde6ecbcafea52220d7c97eb851fdb0bfff97cf691c9e6d7c198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248120, "uuid": "52f23ee5-ac17-45aa-aa89-d32ebb6b6926", "value": "T1BF34223E3EB15BADD292C3714BF26EF086A565A62282D321D23DC7541E7438E0D7F660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248120, "uuid": "4a610259-2e29-423c-933a-3d38b8b0e6dd", "value": "3072:RinafG+iwBxtCe829Fri1BsKDqR/49qHEkuOSX:AqtVBOef9sBNqR/49qHEkuOSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765248120, "uuid": "9eb45299-935b-43cc-b41b-a27be1a36830", "value": 240420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765248120, "uuid": "d33942dd-f2dc-4693-b546-a527a546473e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765248120, "uuid": "93875d9a-6c35-4ce5-b682-9ef60ad01b46", "value": "Demon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4430f16-d51a-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765297219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297219, "uuid": "0b035e77-19c8-4da5-b96c-da6c97a658f6", "comment": "Malware payload (XWorm)", "value": "06cf5d0c042b9f70e8a5de14f01d767d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297219, "uuid": "c1eb7f09-d575-4929-b93b-f4af27d765ca", "comment": "Malware payload (XWorm)", "value": "f6273600e3d9c7e73ea3ca1fc3b643e6a8d95dc96a2ed26e4f731f2883ae414f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297219, "uuid": "88c242e4-ed2a-499f-b543-90b7b3b9398e", "comment": "Malware payload (XWorm)", "value": "94ebb0b402954e20b73e7f6515d8b308048b7433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297219, "uuid": "490c3471-931b-43b6-9804-0baacb87484e", "comment": "Malware payload (XWorm)", "value": "9a965814e503341a2a5b415a916b377085ab456a7be8408609d836351c49db84765c77f5c0afa4e17db59d0a492b1540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297219, "uuid": "2e016e7b-1d83-4b67-9d30-84da486a9c59", "value": "T10CE70217B24E673EE47A8A3509769A40943FBA60651B8CA3D6F00E4CCE2E0651D7FF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297219, "uuid": "2234e1ca-1ae2-4059-a6c5-aab6bc0e2c17", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297219, "uuid": "db7f180a-c8c8-481a-9116-2d0f764ee59c", "value": "98304:dDbkajArpzrh3BfRnLn/9TnTFDsm/kJV8x:dDbkGKpn/Nqm/G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765297219, "uuid": "3f21200d-12da-4df5-aa90-ddb2a0f7b13c", "value": 65798969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765297219, "uuid": "a605b276-1663-4ce8-9839-9237f0d4ac66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297219, "uuid": "336bed03-2adc-4c27-9a47-53de0f6c5d0e", "value": "06cf5d0c042b9f70e8a5de14f01d767d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae78d2e4-d51c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765297961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297961, "uuid": "520f87e5-6eac-4484-840d-ea21b6cdb892", "comment": "Malware payload (Mirai)", "value": "58f181548537cf52f20c2c70d5a3300c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297961, "uuid": "3b662742-39ce-4b87-8ba3-c574ce56a710", "comment": "Malware payload (Mirai)", "value": "f717ada653d0adf9a0f1a7c338c9b03521fdc0d8a78356dffc7226c47588dea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297961, "uuid": "26f15ad6-ee71-4f08-98ae-417e0f2415e5", "comment": "Malware payload (Mirai)", "value": "0a627494ff5c0fdc1268105e95f2cbddeb2a3cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765297961, "uuid": "5674bec2-d723-4603-a6dd-7e87028e9322", "comment": "Malware payload (Mirai)", "value": "e1ed83544b13432345e6dfb5ad4aa626a9b3cc2cf1340eb28bb3561d90f4279407c134dcaae4fc53cec269ec785a4030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297961, "uuid": "00d494f3-1404-4b26-995b-960770997f47", "value": "T1BF24728ABF903FFFD85ECD334295CB09129C491A1294BFB62A74D518B68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297961, "uuid": "e52bd549-55c5-4401-a2b3-711e51a3071e", "value": "1536:emM6WAe51SGffJ9Yjms2aNK0/5dH/8FxbDrc11JRiUwuRxh4NdmhgsC8ElNVn5hX:emjw51SIJ9Yjrrf8IhRAQhDern5EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765297961, "uuid": "a87602d2-c9ec-4a75-a120-0a4482cdd39a", "value": 227620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765297961, "uuid": "798866eb-a739-4376-957b-dfee95766485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765297961, "uuid": "ee0e7463-3e9f-4ee8-b75e-341c643f42b4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c534b3f9-d4c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765262351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262351, "uuid": "9ff286d0-06f4-468d-964f-d4ced2b4a016", "comment": "Malware payload (Mirai)", "value": "f9284c56de0e4c642c03b71c98d0559f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262351, "uuid": "1b5209d5-7e69-421a-b840-e019740d725e", "comment": "Malware payload (Mirai)", "value": "f7ec82a9dd685d548b96876f7170e02b841d4194ea4fd3161988d7fa128208db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262351, "uuid": "8764f976-5049-4182-bc85-1691d96af268", "comment": "Malware payload (Mirai)", "value": "ae2fc487aa8c3c12c39a86c886185b6f5c2b31a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765262351, "uuid": "2ce01b9a-d9b7-49fb-b869-b0331c44cc6d", "comment": "Malware payload (Mirai)", "value": "25672af7011acfd4ae48d05e9cb4454767a830e6d80466ef1a33b4d7991eed7757a541b36a5af94d009edff814426cb0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262351, "uuid": "136cf0ec-12cd-4be0-a17d-3d49eb6ab13c", "value": "T1C5119D893270610470A98D04B29BA608D277A6B1EAFD1E15FCCCBC3BCDC9609B10CF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262351, "uuid": "dd4642b8-8b44-4abf-9cf8-9ba5071f92e5", "value": "12:+fCVva+lfCAut+lfCeNI0sA+lfCDVKJEH+lfCm+lfCcPwPzJ+lfCD8Mgb+lfCH+j:qIv9b3NI/AKhcTSIZPeBpTKFG3xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765262351, "uuid": "a2cbb4aa-ce5e-4ac1-8442-b4e5e4eb5d85", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765262351, "uuid": "5bd7e058-0dcf-4545-8ba6-5974671eefae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765262351, "uuid": "71095388-c452-4774-8385-8015e66de063", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c8d846-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298689, "uuid": "95284f9e-f9d8-486b-9be3-28a8230dda1e", "comment": "Malware payload (Mirai)", "value": "438dace1f176c2ab3f3222d71b96946e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298689, "uuid": "edf1665f-e961-45e1-9c37-fdd6a68841f8", "comment": "Malware payload (Mirai)", "value": "f7f9df91b9c087e1860059473526ce8bf260aa34effa2d5b46568ffa6ed585fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298689, "uuid": "c422f487-e486-4018-b94a-86685a501495", "comment": "Malware payload (Mirai)", "value": "ca326bde5bc1b93d737bbe3251c62dab80cfdeb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298689, "uuid": "ca0221b1-5a07-49d2-88aa-76d5b8554202", "comment": "Malware payload (Mirai)", "value": "324afa12fe7232c963f0b2ce5f9fb4efc97f1c7189afe1bd414fb9e924f697969738c1272057339747840225772e93e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298689, "uuid": "83604f24-b090-4c29-81a2-94279ccc4a47", "value": "T1FB137D76C43A6DA4C14956B4F8314A749F03F500D2A71EFB5E8589764043E7CFA0A7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298689, "uuid": "86a81089-faff-4013-accd-c044d16b3148", "value": "768:U6aZwt04jV95eaUDkcpOH6vS7HIFeuBjjU3CBoLxqClNT:daZwt0sL6k36vgHo/U3N9qClNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298689, "uuid": "736d0833-6cae-4a16-b0bc-0577d535734c", "value": 45068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298689, "uuid": "82bd1c4a-1c60-4658-a473-c54171e206c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298689, "uuid": "11a98d2b-94b2-4457-bec1-2a5c762abd7b", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d50245b-d505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765287919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287919, "uuid": "a5464009-9aa3-4352-a7ce-3cd3aba9deb3", "comment": "Malware payload (Mirai)", "value": "447794016960c960c91b5695bd51a642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287919, "uuid": "4ebf56ef-a302-4b21-b67b-d54e23bb4228", "comment": "Malware payload (Mirai)", "value": "f9a2fed36d469c9da23bee51c6c3465e5c1e8ae41a2fcbec85fab9cfd6db44ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287919, "uuid": "d434ae53-c824-4213-8d60-6f4398bc719b", "comment": "Malware payload (Mirai)", "value": "35e201bbbda0ecc56d96b2a739510ed0d509ab8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765287919, "uuid": "a631d634-5043-48c6-9fe9-9b08a4507e52", "comment": "Malware payload (Mirai)", "value": "e895a637132b532151580243971896a36f9bbda911377e99eb49f75aa6d251973f604af2ad981077d15901975d05888b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287919, "uuid": "116ab23b-726d-4fa1-9cd4-321124466649", "value": "T1EB436BA2D41C6EE4D1089EF479388A7C2733F80995633FB2A75B85A54087E9CF1447B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287919, "uuid": "d01c3ff3-f1df-4d0b-ac3e-6dfb0a833568", "value": "768:Jd9YJD8M0PmNUb0/t2HlBvIHo9IWzRz77sFEv:JdCJYM0PAkFBvIHoaWzRjsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765287919, "uuid": "da47ae7b-21a5-4e2e-b09b-5aa03f4c3797", "value": 56048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765287919, "uuid": "b7edf11f-2d8c-4f27-9bce-3c65c1a6494d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765287919, "uuid": "6dccf496-85fb-4d07-ae58-228e32b9a6f5", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6022c76d-d51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765298688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298688, "uuid": "6b35df4c-8d83-4bf3-b90b-19f1531a4608", "comment": "Malware payload (Mirai)", "value": "2d5bc87e933369365a56e950f59abc01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298688, "uuid": "3fe2e89e-b497-4c70-b187-269abe8d1e2a", "comment": "Malware payload (Mirai)", "value": "f9d7b03c2dd16b6f248d7c115fbda30717de01195826c32c2f0d6f502170b34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298688, "uuid": "14b7d1a0-e47f-4897-a2f3-8e389bbe09b5", "comment": "Malware payload (Mirai)", "value": "49cf0de99699a4cdbc8290968e290ed1b2eb9205", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765298688, "uuid": "e6368b5c-dc25-4c02-8e3d-93460ed69281", "comment": "Malware payload (Mirai)", "value": "686164dd66dfc18e8db9af7b05d6ba1b4f4ff81ef969a84ea20aec32442f368623f0799a50bd93dc656a64b43c115853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298688, "uuid": "b451b952-0ef8-492f-b668-48413637e566", "value": "T1A363E74AFD819F11D5D665BAFE0F528D331347A8E3EE72039D146B64278B86B0F3A901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298688, "uuid": "11863749-1a63-4c23-b0b9-8f0ccfa1676a", "value": "1536:atnLUuU9pqz/V9SfZZTVAkTzL8I8Nxe2o/uqOllZriBBzwQkrvT3bsRO:gUuU9IuPVfT/N8Nxe2o/2ezV+vT3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765298688, "uuid": "be9deb62-b12f-4432-84b6-c1af6d4b9b1b", "value": 68412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765298688, "uuid": "40fde5a8-7f91-41aa-917d-5ccb7975414e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765298688, "uuid": "713a46a6-9c8e-4d61-b28d-68a1679dded1", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d8bf6-d506-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765288232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288232, "uuid": "97d9fcb5-5ff6-4d07-93c8-ed033f013fb2", "comment": "Malware payload (a310Logger)", "value": "709662c42d5508682e08ffa071e77eb2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288232, "uuid": "555307eb-ec7f-4e45-85fb-f95701c7c5b6", "comment": "Malware payload (a310Logger)", "value": "f9f42e2c9d1ba70bbf9ba7addb14cdb312e1a98fc5476a692ac72928c155bad2", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288232, "uuid": "9fc51a6a-8389-4f0b-95b2-765a2c9f0175", "comment": "Malware payload (a310Logger)", "value": "c9fc18189b81a2e69fa21f5a32cd42cd14641e01", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765288232, "uuid": "c4cdb88f-23bc-470b-ace1-c280e07423ec", "comment": "Malware payload (a310Logger)", "value": "33da6c23bda985d9e8678ff5c2ed352ae2f1e4827ba31e80ca617e2c0b9f836b6f9e14c57ece6dbd76355c5b1ff99596", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288232, "uuid": "e375a18f-5b37-4b74-96e7-d87b478930b2", "value": "T16355CF027391D062FFAB95334F66F6115BBC7A260123A61F13981DB9BD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288232, "uuid": "ba312602-bfe0-4f54-aac3-cadf2c844923", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288232, "uuid": "fe5801da-1e75-4b84-be98-7add572fdfe5", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFlXUAlcc5JqJpbv2N2yzSQr:tPVt/LZeJbInQRaFpfc0JqJZk2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765288232, "uuid": "0b8234fb-2144-4b4c-9ad8-10e286f9be23", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765288232, "uuid": "1af780a0-1cb9-4cdc-b4c1-b04fd077f60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765288232, "uuid": "b3cb1bff-a677-45bd-9428-bbb84929d651", "value": "revised Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f95a34-d4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765272334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272334, "uuid": "dea34dba-566b-4e0b-92bd-5a826a8b3440", "comment": "Malware payload (PureLogsStealer)", "value": "49382279198b796663f0a88dc9e634df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272334, "uuid": "807fa860-d4d4-489d-a87e-d6d38eccdaab", "comment": "Malware payload (PureLogsStealer)", "value": "fa83fdb373d067023293567d76ee94ce0a4b592e6193c58025b7725dda06fc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272334, "uuid": "711ca4f5-710d-40c6-bc23-9de5ffe033dc", "comment": "Malware payload (PureLogsStealer)", "value": "bd8caea98e1c4e200feeb144497a64dc2131bfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272334, "uuid": "698e653a-448b-493b-a6bd-9f253d99a8a0", "comment": "Malware payload (PureLogsStealer)", "value": "18a31351dc4a52a491e09d1261a6ef367fd591335117f9af128a19613e36cfbdde1e949742442f00013379f4ffdfdf2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272334, "uuid": "7e382ea5-05a6-40b2-ad21-460ac55537ee", "value": "T1F6C4D0E6FCE1F4AEC49850F4C69F8E828850789D5B820D656397A71C14E320DEDDE2F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272334, "uuid": "9ae34b12-965b-40a9-8139-b0e7e5e71893", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272334, "uuid": "7a391fff-7614-424d-952a-6507c00c8169", "value": "12288:4caQh7Bepfe4KrrF2YlJ4ZU8EcWVADjY2+DajFmr13MRk:4zgdeJe4KfF72U9VAnWDaRmr13MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272334, "uuid": "a51d6c1e-f946-472e-aa72-f57f771ee9c7", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272334, "uuid": "edd689fd-71bd-4904-8e17-558c96fe0c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272334, "uuid": "5ceb7625-7684-467f-8f7e-249e2d53a40c", "value": "KJ-103Swift-CN8400-GF4022-PL0039-YF4893-CHF849-JDE0003-EA392-KS9400-LAWIW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8701f4f1-d495-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765239912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239912, "uuid": "a39b2c1f-ff4d-4ee7-859a-debd2488dbb5", "comment": "Malware payload (Mirai)", "value": "c95b9b5932a7b6706e004b40494a4539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239912, "uuid": "842d9357-fce4-48ea-a610-fc4db3c414a5", "comment": "Malware payload (Mirai)", "value": "fb4edc4e8dbe31133b57d66f624ec9fb5de63a19d15b6a321615f6daa7e746ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239912, "uuid": "13d82861-2f67-4472-ab44-7b48fd5ea3af", "comment": "Malware payload (Mirai)", "value": "b325a75ac1c85f103e628a0217f363af79147849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765239912, "uuid": "d4f01a67-bd72-47b5-aa89-a003494ccb4d", "comment": "Malware payload (Mirai)", "value": "2f8223238eb402730a66cde86ba1e114bbbc8970d3dec27e6e186b638f260d4d838a433f75c32b6b9a9dfca57bab8a02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239912, "uuid": "c240ecd3-026c-42fc-955c-5bb66bd20d58", "value": "T1FC633BC8A5D3F9F0DC150A3D747AAB725A77F13B2139ED9FD7A81966A802302D40239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239912, "uuid": "367abd72-43c9-48ed-a4ce-49e88a133c1b", "value": "1536:mOhjXtM7ayXRulHeEqPZTSMLKi8eKOMJ37w0hLsQ4:mkXO7ayUJeEmZTSqK9eKOMFMQLsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765239912, "uuid": "eb712fef-c24b-47d2-83ca-8790ebc664cd", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765239912, "uuid": "ad51afb8-ecee-498b-bfa5-4137bae086cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765239912, "uuid": "fc03f048-1e05-4d24-99d0-5b367a3f1118", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2b259c-d531-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765306708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306708, "uuid": "69ceebb1-26c2-4b11-9eef-7dc29108fa8a", "comment": "Malware payload (Mirai)", "value": "10a52c8c35753a8205dada2366cac582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306708, "uuid": "4b1f1e26-12af-4593-948c-aeb961d5fecd", "comment": "Malware payload (Mirai)", "value": "fb8dc7f6629a8bd451031e9a944ad1b771f18d4c1b62e0dab6b2ae4c9a18a3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306708, "uuid": "bf065e24-e7c9-409a-9761-c329108b6bfd", "comment": "Malware payload (Mirai)", "value": "670d6b2a893c07ce543ef380026eb0fec7d78d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765306708, "uuid": "566c7944-8659-4e67-9168-90974360467f", "comment": "Malware payload (Mirai)", "value": "c2f2b6a7333909ca031159102dea09e8c77e2bc943815a22c88636fc627b8855da967ca1accea4e4b66812f4760fd5c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306708, "uuid": "244a1715-01db-4bac-bd87-dd3aaf933ff4", "value": "T1D373020888D983E1C4346179D8FEF6669C35A15BE664E33B8BBC22712DE0FC9E55C522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306708, "uuid": "d4837464-cde9-4b35-96ba-324b0a1202fc", "value": "1536:n/EUQDvUTB98sjFacxoTowTjSkhbL3mfhCv8JOYIOzjME+BAvRITHnouy8Hy/:n/ERDvi8wmjTjS43WwUJyOzQjiRIDoum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765306708, "uuid": "cd8f1060-e07a-4021-9d3d-7dc7c530d47e", "value": 78788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765306708, "uuid": "29ec4c46-660b-4ee4-a8d2-a50b9836e1c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765306708, "uuid": "06e81caf-da73-4130-ab63-d3a5d610f5e9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152a9c6-d4df-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765271847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271847, "uuid": "c75fc54f-d991-44af-a871-2e02bd5fad6b", "comment": "Malware payload (QuasarRAT)", "value": "0f3ef8549ed721e4554e14d1af8d5846", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271847, "uuid": "7984207e-6c58-4554-8295-9d94422e47b1", "comment": "Malware payload (QuasarRAT)", "value": "fc10f366564e61290add3a2002142b7a6f24c5a434ed1201d671b32d8ef9f84b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271847, "uuid": "262dd57c-bd5d-479c-a911-77579279bd78", "comment": "Malware payload (QuasarRAT)", "value": "8b9b82510518b0cde337ad76f196dd48983b5aa3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765271847, "uuid": "a43b2d55-4fa2-4af0-af67-2e6f2315435a", "comment": "Malware payload (QuasarRAT)", "value": "593d3ab1d07e89ca2b37d74f1fee183fcb9c6b84e023b4fcc2dbf3cf2f3f11b8b52ee4e3bb55765ee8a66fa5f5b0862a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271847, "uuid": "c661cc10-3eaf-46cb-9a57-c8ba15d3a9d1", "value": "T1A1E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271847, "uuid": "a1458213-46f8-43e5-aa42-3c806e2239b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271847, "uuid": "6f0fba90-d69b-4297-a63d-1c1ae080077e", "value": "49152:svHI22SsaNYfdPBldt698dBcjHP8QaEf/Jk/M5JoGdKH48THHB72eh2NT:svo22SsaNYfdPBldt6+dBcjHP8QVnaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765271847, "uuid": "89b99621-442d-406e-9bd0-334160a2ffd0", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765271847, "uuid": "5379c653-1baa-470c-a314-ae2127d5bb75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765271847, "uuid": "96a575b5-ddce-4711-bde3-0107d3ad1602", "value": "1.1.1.1_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42943fd4-d4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765272010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272010, "uuid": "343bd5f5-8aec-4bf9-ac99-10bde65ad3ce", "comment": "Malware payload (Formbook)", "value": "a3ec3f9785f11674d55c77f4239cbc71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272010, "uuid": "2380508d-8b33-4410-b006-f658bb3d0db5", "comment": "Malware payload (Formbook)", "value": "fd087437282fbf742f483ef219fd3a587332e1073979ab343f64141d74e20d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272010, "uuid": "a26b18f9-b7d3-409f-8eeb-e6c498439fd9", "comment": "Malware payload (Formbook)", "value": "10d9d1622982768517de8b76f0d0a6cac13174cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765272010, "uuid": "2b95eaad-6612-46bd-97bb-0fc8b684a7f5", "comment": "Malware payload (Formbook)", "value": "e4802a6353382d610ddcd28a8080c98e681126737aa64078e79424478961fb2dd6d4e169b444e84d73730265396a53e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272010, "uuid": "8bbd2a12-a8c0-4b95-9b1b-42a286470a4f", "value": "T1ECF4DFD03A39672ACEB549749524DDB182F52EA97420FAEB1DD93B8B35DD7009E08F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272010, "uuid": "e47c1dd9-9b23-4366-a98d-7d6514e65e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272010, "uuid": "d262de73-999b-41c4-aaae-c898520c476f", "value": "12288:uuYAob0rluiKG7HEivmxWv3UqDTSBoSnHPy+fm6l9Si8e4Fp:gQrlujG7HvmxWv3UeT2nDfm6D8eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765272010, "uuid": "3c94717f-b2c9-4233-bb28-da730f19fad3", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765272010, "uuid": "03bc9678-0d46-438c-8adf-007c75d90e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765272010, "uuid": "bfcb5a47-a905-4428-8b16-4987be7ef499", "value": "Adobe installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23863723-d527-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765302452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302452, "uuid": "31c426a3-9d39-483c-b92a-af24205edbfb", "comment": "Malware payload (Mirai)", "value": "265695fab7dfe1e89d69cfe17fb391d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302452, "uuid": "f3f9a316-543f-4740-b307-b90a8da8be49", "comment": "Malware payload (Mirai)", "value": "fd0d3f7a0ac714cfed5b2edb3e41c207157783a9cc61f84335d7e6e540c2241a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302452, "uuid": "f2445de4-01de-4b54-b35d-1e49878ba989", "comment": "Malware payload (Mirai)", "value": "c05a30bb86c11b74e8a1de882e8739113044ae1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765302452, "uuid": "5d145d76-3edf-4d9d-96f3-8abfe7c6bb0d", "comment": "Malware payload (Mirai)", "value": "927458190ca5bdc32b072aff2332799fadda887b1d2cca97b511bede0e8609216a3bc3f2c20e80c87f8cf53850ec19af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302452, "uuid": "03d18ca0-d871-4f40-82e1-cea7b35a470d", "value": "T1A993E746FC819B15D5D922BAFE1E518D335357B8E3EE7202DD105F24778A82B0E7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302452, "uuid": "7d8812f7-2e64-46e5-bdaf-cb314918ea22", "value": "1536:yhn6waBXejtmcVmr4Myq8vELUiD8hMEL0jYQ2RLxh8cNnDli9l9ritBVBCquT3bv:SOXjcVmr4MnE/h0UQOLxh8cNncsBVB5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765302452, "uuid": "681c7813-a83c-48e2-b670-72599882359c", "value": 89616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765302452, "uuid": "b9896599-5ff4-4ce2-8143-cb146a1d52cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765302452, "uuid": "69da7216-514b-42a0-aed0-b397bcb46b07", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bae2536-d51a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765296963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296963, "uuid": "94f0843e-a604-44eb-9f35-152df01b9823", "comment": "Malware payload", "value": "f0e0b6571eb7a78c625f3b4a861cb62e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296963, "uuid": "e1ea86a1-13b1-4a12-9302-7ed39e7d8d04", "comment": "Malware payload", "value": "fd853807beb17822d8654b02f8ab34feb54f60e2d844cdce29a0a4976725739c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296963, "uuid": "73cd287c-5fbc-4a39-9b84-bc3fc8ff5a43", "comment": "Malware payload", "value": "82779098a4676cc50dcc47bc63fad99c6087dd32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765296963, "uuid": "61e536bc-bf17-40b5-8925-a9fe11fafcaf", "comment": "Malware payload", "value": "cbcce04014681a8e37ccd55a16463127d25d095a69be9eb4c2486171e5ef85bed1a3ce629da6ccc13fc2bf977e9be15f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296963, "uuid": "044090b3-aff2-4c78-9734-4ac7f8e77b4a", "value": "T1DCC3E799B8819E22C5D116BEFE1F52DD33231BB8E3DE3207DD156F2436CA91A0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296963, "uuid": "eee648df-d618-4aa9-8e27-f3abd584977a", "value": "3072:QJ68tJqtJfthX2p9QugEYPRd82tx24MSJKYXirQktnP1qn59:QJzittthX23QuRYpdfYjXYyrQk1c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765296963, "uuid": "c9cdeccc-1671-4d2c-a98a-f2695bd1e9c5", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765296963, "uuid": "e353bb78-4209-420a-951d-45ca39e3d434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765296963, "uuid": "1d46214c-6716-4c85-993c-8817862b2861", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9cc54a-d501-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765286311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286311, "uuid": "94de9310-c206-4fc6-b33e-3b8c0749446a", "comment": "Malware payload (ValleyRAT)", "value": "12e08c15c2bfd06bf6c5deaf12c6efe9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286311, "uuid": "4a10946a-026e-4c10-83f8-18b1da1474ad", "comment": "Malware payload (ValleyRAT)", "value": "fe4c8babbccd1e5b38ccd04845ce636fbe9d10c38dbe30c0638fd4180cf6fa8e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286311, "uuid": "3f5f83f9-9bae-41ec-ab92-f3b9737795ac", "comment": "Malware payload (ValleyRAT)", "value": "03f4895c02e26d84fb60372be3a87eb73ca4f9e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765286311, "uuid": "416905d7-285c-404b-bfaf-7d339f3233c7", "comment": "Malware payload (ValleyRAT)", "value": "4aa5f0b52b5efe06704d7e103cd8ff64a7a3aacb5d3072928cfa3ee67816bbace3f64bbf4117a57ae60d025682a76922", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286311, "uuid": "a38d13de-921f-45b3-8eb2-5ba8597c2b41", "value": "T105222D3DEACA44F2CB9949B456A3515E8BBCA50337C6313BFB6191570FC4325C4A13B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286311, "uuid": "998be067-d10a-476d-9920-1a90cdeaa714", "value": "9a5714163ec9658d1f68a4609460fcb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286311, "uuid": "1d5a81c4-b095-4d6e-9ea7-de3be4f30b05", "value": "192:i5Kxp9PkKXgKYjND7rJcVb3MAmcLAIV4zZ46c3XP8qrsrO:i5axk/zhrJMMAm2cU/cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765286311, "uuid": "05a1d60d-9560-4f28-9ef7-eb64dc0ffe9b", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765286311, "uuid": "c55597c0-108b-4449-b5e6-c4d9cd1b2982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765286311, "uuid": "d61b7b50-7cab-4a5c-8af0-7a962f7fa013", "value": "bassflac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3e30fd-d496-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765240461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240461, "uuid": "039c8909-8e3b-4f8f-9c03-734d43bf9b90", "comment": "Malware payload (AgentTesla)", "value": "de352f3e57a1f26344aee1c4c5f93e27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240461, "uuid": "8b08d64a-3464-4092-a0b0-fff96b16749e", "comment": "Malware payload (AgentTesla)", "value": "fe74b8f72c806ce6409697ad6908d312501e693cd97593d53293784e19fc883a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240461, "uuid": "615ba33b-a0ee-405c-8ac4-3279751dca34", "comment": "Malware payload (AgentTesla)", "value": "85d6e9983153b8d87808ccc85460fd41d3c42b7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765240461, "uuid": "b4f7af34-986f-4f40-9610-2b74e8b2d1f6", "comment": "Malware payload (AgentTesla)", "value": "805b5bea7641fc9bb112bfb3f9e5b43c185dec35a28d7ca565723b2cc667436b31438b97c17aba17eecccf4064e20613", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240461, "uuid": "a9575cb2-c92c-4348-a1c5-df1003de1f5f", "value": "T1D3B42314B791D00BE2F24D383D292179ABB4D6BE55228F0757402E6EB4F82C3DEDE1A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240461, "uuid": "58385a1f-8a13-4cd9-9ac1-72fd3e623a49", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240461, "uuid": "20ae1599-2a70-4874-89f1-39900003791a", "value": "12288:JThiYjFkDpjG+1bAMIu5x/ID33CIKeed0pm/0nQQ:JThV2Y+1bFIu5Ynru0pmMnQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765240461, "uuid": "1b3b77e0-44a9-4768-9302-397d10c5c968", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765240461, "uuid": "721cce40-11b2-46f3-93b7-0daabce2c1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765240461, "uuid": "4fb3bd15-4618-4ff1-9dc3-4a3831a86af6", "value": "doc0012020020250212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be4e9e-d49e-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765243809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243809, "uuid": "f883a1d3-bb5f-4385-8faf-14349b9d8234", "comment": "Malware payload (MaskGramStealer)", "value": "dafbccac432740f08b75a962fe1b67f4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243809, "uuid": "9fd09616-c1a2-4ce8-a137-74b61a59f4b2", "comment": "Malware payload (MaskGramStealer)", "value": "ff471332a31788ad2452df4f670d8bd8e8811b803ad46e38b0ff90d9187d2a2d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243809, "uuid": "9dcd1dfe-1a75-4941-bb74-34aa90587e06", "comment": "Malware payload (MaskGramStealer)", "value": "7b9f945a98900df54c30a370fe67a54ba5851d50", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765243809, "uuid": "6f6bfb04-3698-42c1-8654-4545be17cc39", "comment": "Malware payload (MaskGramStealer)", "value": "7b2c8b018e8434d3f6b7c59f1fac5adf5e04acf91254cc7ef03ae29b1de90f252853903d7370226b5c2ac9026cc5f865", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243809, "uuid": "dbaebe53-75a5-4e98-b1eb-88ea1e18f8c3", "value": "T1FAA533493D68BA07C9B377F4EF4B21109766AD31B48A60F65F4C8B835C2F906DC71562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243809, "uuid": "7f4bbedf-24a2-4c40-944d-f3443706464d", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243809, "uuid": "ee2e6d18-4c8f-4cec-80ac-153725d91efc", "value": "49152:734GyRJ3u7ose+VdfwXs/1/OykvGhsrDJoz:73zyR9Y5eWdf4swyWGhsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765243809, "uuid": "9e5f0e39-9bf4-4ff1-800b-15266d58b523", "value": 2166272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765243809, "uuid": "f5dde842-b7c5-434d-9165-48fb06a3c119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765243809, "uuid": "374b2c28-1bf3-4644-a920-dbb3e8dbf6c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }