{ "Event": { "published": true, "date": "2026-04-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-23", "timestamp": 1776988982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "83244be7-79e9-4529-b090-89b43edadacd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1976ef0d-3f20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954252, "uuid": "389cc067-9b7a-41b8-8d12-82baa89cdfe1", "comment": "Malware payload", "value": "2953f572d00c5b193c86a9e64782a625", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954252, "uuid": "8b04ea3c-5842-4173-aa1f-988301ca1496", "comment": "Malware payload", "value": "004afa969be8af9bd03722c4554fe83807e94f8a5a8d1bf93c0043caaa1cd7d4", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954252, "uuid": "1d7bcf9a-ba9a-4beb-b1fa-486e9499bdcf", "comment": "Malware payload", "value": "8390652f3c9530df5f569594cafe796533b14447", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954252, "uuid": "31f07879-6f3e-4583-9a44-3f73fe8a4898", "comment": "Malware payload", "value": "708d3815f60dfe0a8192b9c176e014bb1f21eda2f95ebe6b51939fd01412b34789255d00848c38700232e84ad5ac423f", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954252, "uuid": "8f02d660-5ef5-4c0c-a4c7-768119c26adb", "value": "T186A5AE65E3CC6699E427C779CB11A323D2B2B8120776E0CB069A17061FB7ED25B3B605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954252, "uuid": "eea82e7f-9bf0-41b7-9ed5-30c4c24fe6e1", "value": "ad229f0ba4886706cebec7d1c67b3d06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954252, "uuid": "802e9022-afec-484d-be71-93dbfb1ec9e8", "value": "49152:qVc+mjPztYbHXN5nPWSILFqkf9jdRbzN3nCI2MX7zfD:AYCjktdRbzN3nCI2MX7zfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954252, "uuid": "1d4ad2f6-1ce8-4ab1-821a-22e75a20c8b6", "value": 2115584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954252, "uuid": "b741c796-2c3d-445f-ade5-9e8ae580702e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954252, "uuid": "1d363d20-e722-498a-9c9f-07641b8617fb", "value": "BugSplat64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da66bb5-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926530, "uuid": "f911e672-de9a-4d5b-9c0d-053057399c38", "comment": "Malware payload (Mirai)", "value": "79db653d69619cb4dcc7627e29493c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926530, "uuid": "54add9db-4385-4e64-a5b5-a1edcc69be14", "comment": "Malware payload (Mirai)", "value": "00a3fc9e594aabafbb6998f3f10e1fce34dcb923bfa4b3b22ca3fa9986dc1c89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926530, "uuid": "e6b52925-14a0-4e78-9d4c-01024e3b9bbb", "comment": "Malware payload (Mirai)", "value": "f4e1288bf6bf24eea240c84963944ddbadeed8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926530, "uuid": "3a20789b-6e11-4760-9ec3-c04e87bd2824", "comment": "Malware payload (Mirai)", "value": "b12f597f69fe6608bd053b6c017e1b1cfd77bf1dcc8a8dc3c171b5df0e79d90b2af72c14f1c4698328e1ea4b8e718fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926530, "uuid": "2639b7ee-ae7d-4dca-96c3-11c54b997da5", "value": "T1BD041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926530, "uuid": "7d50a0d0-177d-48ae-967a-23103cd4b34d", "value": "3072:t+0NrtUpT/5dltGgXGGP9M4S8lrXwU2wonacrI40fCtZ1SD39rsJj/s9fx49SY2Z:tDnEr5dfHPq7UToac8uF9X0V6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926530, "uuid": "b785db3d-fcf4-4d54-8376-36d048e41e0a", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926530, "uuid": "a9a2975d-6946-42a5-82cb-31371d4bf4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926530, "uuid": "8aace055-e28c-4b34-9064-e83ceef1288c", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1340da30-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776931478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931478, "uuid": "a202eb41-840a-4876-b58f-dd5a2bd42031", "comment": "Malware payload (AgentTesla)", "value": "c444dec2a7efb04a9f2eda0b6a52abd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931478, "uuid": "2017a4dd-f9c2-4371-8ffd-2013801eb211", "comment": "Malware payload (AgentTesla)", "value": "0109563f78140004296a0aa0d6e7d433946e2ad3b2953d7a504be9a397fbdab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931478, "uuid": "e362d193-2d1f-47aa-a3f6-600766867d1e", "comment": "Malware payload (AgentTesla)", "value": "daf4018a162f661c51d721e1cf6d0c42150720f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931478, "uuid": "e88994b1-aa28-44e1-ad7d-f0b1e7e99c05", "comment": "Malware payload (AgentTesla)", "value": "aaaa5b8843deaa336401d6199ce9368066d870c62619bbe6e6695b5285a48d5605c2cd33d5ec4c4f75ffb63939584857", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931478, "uuid": "c342c292-d020-4b18-ad15-4f5be9ecc58d", "value": "T12F65F21189C82FB8DFEC5B1890FE160E93F0498A546A7989EF33FD46AFE7604510B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931478, "uuid": "bb641406-fe9b-43c7-89d6-eb915ca0e837", "value": "24576:YNt1hfUcFcMhB/svDE6fC0LxHmaQT+nRzZ4GMEiRcg1X5P:Yn1pFB8DVaAThRe65uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931478, "uuid": "b7a50578-f5e6-44d3-8e25-7528dfaecc24", "value": 1427288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931478, "uuid": "9b4a02ee-3b60-4673-ba4a-f379b559122d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931478, "uuid": "88558edf-6041-491e-b3ed-885a0876b2fd", "value": "Vessel_Main_Information(7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b051613d-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776954075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954075, "uuid": "5f47d9fd-2294-4abb-9273-17eda0feef5e", "comment": "Malware payload (VIPKeylogger)", "value": "fc75ac3367f3935f09a106ed02ab490f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954075, "uuid": "1a64c449-1475-4be8-9a60-493e7f532004", "comment": "Malware payload (VIPKeylogger)", "value": "019989a863f29a5259998d3ac6370326fb08c32951c5a63c8512d4516aa84e16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954075, "uuid": "73a72473-62a6-40f9-9ef4-69cf2f3d2063", "comment": "Malware payload (VIPKeylogger)", "value": "57bb16438cd5f8193f8b820e6bd9db0b2dd18309", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954075, "uuid": "47677084-e736-49a1-a14b-8ae5119ab223", "comment": "Malware payload (VIPKeylogger)", "value": "5aee61d5231d1967ecda7dbf346e15bf0d10ed4d70048a1ccd1af3ee0d6eaaeea0bf74eeb410f35e8b91aaac064212ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954075, "uuid": "133f7911-48bd-4b73-892f-765d46b6f5bd", "value": "T133B510511C2429E41CC0C28745AC6B988E9C47C4AFA10FAF3F9EEB5E62E5C5BD66C4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954075, "uuid": "2f448a67-3048-4f3d-b3cf-855907efd7f5", "value": "96:DQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3EQ3i:+y2ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954075, "uuid": "68f22710-112d-4d69-8d99-3da1137786ee", "value": 2290196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954075, "uuid": "0c0e0186-b7f9-4e89-9c5d-87ef2885c4a6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954075, "uuid": "844c2d31-287d-4604-97c6-b211230d1efd", "value": "Faktura 01878-260422_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7472d5-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928242, "uuid": "6a2c904f-6fb8-487b-9e23-92ae0364f26a", "comment": "Malware payload", "value": "b07852e4c9bc283f79eae8ee89134019", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928242, "uuid": "828d73c4-7645-4702-ad4f-9870c8ebd1e0", "comment": "Malware payload", "value": "021b2a4bbd97c258dc0769696980fb9bda343e92f433a4dae52abdd183cfba6f", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928242, "uuid": "136ac2e9-7571-4be9-816b-a72cdac9b9e9", "comment": "Malware payload", "value": "79dd56edebbf6c32f2dd26af593af887eae4da1e", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928242, "uuid": "f1eb131e-da1b-47f9-8c30-346f543a3ff5", "comment": "Malware payload", "value": "b47332dbb51da407343bb0b4890cff2205bd2bedebdb5bd6b6a3c24041807f4a19302244cc7f1e9eded52fcc46482f21", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928242, "uuid": "4473e464-43ad-438d-b02b-74705a2e6730", "value": "T1B62713436E1E0DAF87E541B80DBA188F79EDDB604130A8DFA69714D64F3DA27120F8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928242, "uuid": "807f9b0f-1718-48fc-80c3-ca29eb1ad962", "value": "49152:kVXTIVXTfVXT3VXTEVXTSVXTUVXTtVXTLVXTpVXTnVXTxVXTxIVXTrVXTqVXTWVq:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928242, "uuid": "c1ae0c5c-0fca-452c-9d55-1caadd0781da", "value": 21131467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928242, "uuid": "81406c44-250e-4b41-b730-8b69087a61b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928242, "uuid": "d01b180c-b6a6-4e50-a623-d4251c85f4be", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28358e61-3f0e-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1776946546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946546, "uuid": "5b2abfc2-f754-4418-9caf-07e63e10cbb9", "comment": "Malware payload (N-W0rm)", "value": "dee76e47298d2836ef2cb662d3f70a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946546, "uuid": "4bd32708-ffb4-4326-9df9-423a88a76307", "comment": "Malware payload (N-W0rm)", "value": "0266ac5b68036849f1bdb5575ed7b9f4ba4ba6a28205999e6a80970e04b3675c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946546, "uuid": "fc844cf5-59db-4144-b1c4-a00693f85b33", "comment": "Malware payload (N-W0rm)", "value": "1b738eceebaf369810c0621171fe0adf121615b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946546, "uuid": "c3581c3f-3944-40a4-b791-78239f20e4f2", "comment": "Malware payload (N-W0rm)", "value": "dda23c7de9ea05353465a755154ed67e1891dbafa0578c0a505458b0637a83397074fde00872ef22636f7995e2f25bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946546, "uuid": "aa2d1131-2c40-48de-aa82-c62b52195efc", "value": "T195D4AEB677624E22D2881337C4CB590097B496C676A7F30E7584139659033FAFE4BAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946546, "uuid": "81c95b3b-1a91-4b36-b16b-39c941e8b3d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946546, "uuid": "693e87c6-490a-42f4-a733-d1bbaecb9994", "value": "12288:xKdyxh7CDhhwwZiZm2hFxnRsa4IBV+LGcs0oK+Kd2:xUrXEm4F1uNIGGcWK+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776946546, "uuid": "ec13c6cc-bfc5-44c4-baeb-d3d53f34411a", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776946546, "uuid": "1a454e9a-8951-4464-a7b7-a58eeeea4182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946546, "uuid": "b827c818-13af-4ff1-acb1-4378726a85d7", "value": "DEE76E47298D2836EF2CB662D3F70A21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd22f8f9-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776931334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931334, "uuid": "d40ccce2-fe69-41b0-b3a1-bc2b1c305c33", "comment": "Malware payload", "value": "5eacc7becae19c2e319f0cd3e22db76e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931334, "uuid": "4b450b35-5c7c-4617-93c3-cf71fdfe359d", "comment": "Malware payload", "value": "02bd3f91a93f25ebaa9637ea6949f555b7cdc47a216f051cd2b24612540b792c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931334, "uuid": "edd9d651-8a3a-49fd-92da-b82f0a1fa4ba", "comment": "Malware payload", "value": "202acee4eae4f662e28ac9bd06d04ed4b5204f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931334, "uuid": "860a80c9-aae6-47c0-af4a-b8cc68d2d369", "comment": "Malware payload", "value": "823409e403ec1fac858f2d29a93f50d42a876ec256ffdaa96ad95a8b7e2e58e5df8a66dd15ff12e12b75df0b14bce4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931334, "uuid": "9d9d3614-b3aa-4a6a-be3f-5b530107fa99", "value": "T190A59D05B3804AB9D11BD638CB679B32D2B2F8214776C58B1E56DB0E2E73BC15B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931334, "uuid": "e0ad3eda-31ff-4c06-bb59-ae5a4053d53e", "value": "20fc126851771237a632c56439029aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931334, "uuid": "59b7e8e1-afa1-427e-a81e-7e647219adc0", "value": "49152:UTmvLempHoiltpRdvvvvvmmRcfFJMn8O52jr1koOeUlVg1Gc92fkZQyrTh:om5HWTOeUlVg1Gc92fkZQyrTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931334, "uuid": "ca42d779-cf6f-4f6b-91be-033b78b9c830", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931334, "uuid": "c21dc5da-d2a7-4332-9368-b2387271a6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931334, "uuid": "11b09632-1f83-476e-bc9d-d1f4204858ef", "value": "msedge_elf_22.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778bb514-3f42-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776969013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969013, "uuid": "382daf4a-9517-4181-8e05-00bb87694001", "comment": "Malware payload (Formbook)", "value": "0dd0daec1e4709645aa5d82b32c4e539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969013, "uuid": "f45e3564-e0b3-49be-9cd2-9bb2f05ae187", "comment": "Malware payload (Formbook)", "value": "042f6d8fff507d22bc7a6c7568cfdb9fb48cd9fe1c0eca4c6982f58e22b63dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969013, "uuid": "5785e9da-c949-466d-bd41-1bed6dca1598", "comment": "Malware payload (Formbook)", "value": "13f77564c98e3abc46e0c87d0c0cbf04251bb55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969013, "uuid": "95fb1f57-2a43-4260-bc14-d8570377b103", "comment": "Malware payload (Formbook)", "value": "69025f727a54e4cd081eb661b15272b9c924778943c4944fdce16fb2a440fa20462b5efbd7a6a99869f374ed11bd7dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969013, "uuid": "f27cebab-e260-42f3-b809-2e7bddd14188", "value": "T1A12523A99A21D993CCD15BF219B1E7B007564E4EF400C31BDEEDACEF7D6829624346E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969013, "uuid": "33543571-2791-4e8d-8ba4-81d3f8699cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969013, "uuid": "f1c6e546-2a05-4b4c-9781-48fec6686274", "value": "24576:dO/96nOGyrubkxk7w+5IEmmAMDVf4fGho0e7o:kEErLYwtShOGh4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776969013, "uuid": "f4bcfd97-6317-41bd-b12f-213d09c4cd3c", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776969013, "uuid": "28c78045-0e12-46e8-8f91-1208b6dd1074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969013, "uuid": "82a0c51b-7cad-42dd-8c13-e2dd722a10be", "value": "rRFQ2026-BE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25024883-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776945681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945681, "uuid": "077f8b91-3869-4920-ac61-87a1027dd168", "comment": "Malware payload", "value": "33b2bfe7bd62c0ee00601083995729fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945681, "uuid": "b9dbd8fe-01cf-4831-b486-adbd9d011ac6", "comment": "Malware payload", "value": "048ffb71a1e5abfd6b905b7a4a5171eabe560948963a8c0d6aa14a40d0f6b255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945681, "uuid": "f2fa447b-2f84-4fb7-bfb8-6a892bc54b68", "comment": "Malware payload", "value": "8329dc43b776bf040aa646154016748b688d8ee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945681, "uuid": "c1460e58-e909-420c-91fc-f38556a06a80", "comment": "Malware payload", "value": "94db0f1f6b31a76bac2d692013bb0042a96820b5306986c8f72cbfefb25892203c88c800eea31e7bfbf1f8dd6d72e0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945681, "uuid": "ef894a98-bef9-4bb6-8852-b78b6a57e101", "value": "T16FB4D45011CD9AC3E6AECAFDD58429D783F5A173261DDFC96CA036DD0A28710E624F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945681, "uuid": "d5fe87c6-c6d0-474e-b976-1749453da18b", "value": "6144:KzO9gXJBQDZ7IG0vOyQdrCeZ65tLN9uX2SjGPCwQqQfCh1MOKhT/aWaz:V9IMDZDLrCVnoXhCAqQfChX+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945681, "uuid": "9b7e72c0-84ec-4d27-80b7-63047524d2df", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945681, "uuid": "7a9b75ff-5a35-4f05-8c87-4d4be504117f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945681, "uuid": "22f62eeb-3465-4027-9651-ca3ccbd36f6d", "value": "048ffb71a1e5abfd6b905b7a4a5171eabe560948963a8c0d6aa14a40d0f6b255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1cd001-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968428, "uuid": "f0e194a8-9363-45fd-98a7-3a8ba065a606", "comment": "Malware payload", "value": "caa5e8cf3275339d251210072ebe88c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968428, "uuid": "587eca6b-71dc-45ba-8246-767072b13d3d", "comment": "Malware payload", "value": "05417b82e39c76b0d2582709ff2d643c348837d0434c842d6d80da31e816210a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968428, "uuid": "042d7294-1184-48d5-bd18-997b5f1adce5", "comment": "Malware payload", "value": "89b12465982518e93596bbbb3986652d7cb76702", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968428, "uuid": "397cc437-7de3-4f3f-92f2-d2b9b00891f7", "comment": "Malware payload", "value": "9f06105cd52803cce3b141801a590c83e2f9d197b9d3aa1e4f17ffd71c6091b3fa68a163b28f676973ce53aac4067047", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968428, "uuid": "5d6d4c03-7d67-400d-b833-28340b3d4435", "value": "T14B06F186FF59952FC87300364FA6837632569C138E839B477858372C68B7AD80F59BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968428, "uuid": "22850bbf-3735-499e-be26-0499adaae242", "value": "98304:yJRcHC2/hBcRT/vb9QO1XUMrfaNbsadch8JWmhKJ3+YEFVf:aGCqhBkpp1XUMrfVadcykEXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968428, "uuid": "bc275538-068e-4e56-8283-eedf0c967119", "value": 3954868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968428, "uuid": "247fd4f7-b124-49a3-abd7-8cdc40b97a72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968428, "uuid": "6ea9a048-3910-41bc-8b44-8852b0b0e985", "value": "05417b82e39c76b0d2582709ff2d643c348837d0434c842d6d80da31e816210a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c87802-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934195, "uuid": "15a670bc-3638-450f-b497-085a83544119", "comment": "Malware payload", "value": "64c4808cf106853b850ccea473472b04", "object_relation": "md5", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934195, "uuid": "d270d386-e2a3-4142-bdd9-d9d1404fd6c0", "comment": "Malware payload", "value": "059dd0fc61018ae51c973f5355b2be8ac3788fb6a188f18df632cd28309d669a", "object_relation": "sha256", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934195, "uuid": "b955f42d-b955-41e1-89ff-ead777d95337", "comment": "Malware payload", "value": "150006f702ca07423bb4fb48ee61eae99d6bb731", "object_relation": "sha1", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934195, "uuid": "3c5da434-96cd-42e4-806e-ba0882629cbe", "comment": "Malware payload", "value": "0c9748aec52502954335dc0ab2e92ec051a42268ed676f4295d4d4b02761702d3db9951a725dad608adcce6ce26d4ce1", "object_relation": "sha3-384", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934195, "uuid": "c19f1625-eb76-48fb-8463-a63287f0d9c5", "value": "T176014110E2C7DA69C4E6E838E055B541B2ACFE5296846012905E647D4C67BAB03EA84E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934195, "uuid": "36374b76-c255-471b-aa7a-93df7c8f3889", "value": "24:9hw9eKwvECtuX9s+/IgWVj1YvGFaW3kB1lXIr:9GeKQluts+/dWBPkB/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934195, "uuid": "4006025e-7f12-4fd2-935a-b867fe86b666", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934195, "uuid": "9a0b8047-d70d-41f7-a996-d3eb4a484b7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934195, "uuid": "6b89c470-dd0f-4733-830d-8e3c69667e50", "value": "Invoice_April2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e42b163-3ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776913136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913136, "uuid": "af30cfc2-e038-41eb-9b5c-97c50623cb86", "comment": "Malware payload (PhantomStealer)", "value": "9f86a462681b343125415cee2ce30624", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913136, "uuid": "924dc2bb-6897-4878-825d-95868e741fdc", "comment": "Malware payload (PhantomStealer)", "value": "0671be8c3c90f4f70b4feef76edbf8f3fd8d8b9ceb191675b100912d70e82c22", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913136, "uuid": "dd143a50-70a2-49b5-a83a-66fbd49c486f", "comment": "Malware payload (PhantomStealer)", "value": "5aaffe2fd4ad738032bcf35b960b575a778a97fe", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913136, "uuid": "23944e1c-5053-492b-b7d6-15c9d01498a0", "comment": "Malware payload (PhantomStealer)", "value": "5d72bfb57b0d8a7bd01e39e9230ac069b8412d496bf9a8763ac263ed13807a2cfa1c4faa0f4ed797569dbffc024184d3", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913136, "uuid": "5973ed7e-9da8-4a3d-af21-693d7b14e839", "value": "T14905230E6E9A9F8E63BC437D301FFE0680094696C5C5FDEB64F2E05B18AAC9391F6151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913136, "uuid": "dc973809-63c7-436e-8bc2-5ccccd65466f", "value": "24576:MnqPcpEpCbjcVEB7Fl+KEHNSk+qw4DAwCQ:MnczQbjcmGKGNVZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776913136, "uuid": "28352edf-2d03-41a4-8208-82cd9c13b311", "value": 840983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776913136, "uuid": "bde3e087-a68e-4702-b336-0a8ec35da417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913136, "uuid": "c9b85179-a671-40f2-958f-586fb38f12d3", "value": "sport.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acdbcba-3f2b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776958952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776958952, "uuid": "f55bb218-888d-4686-816c-67ea3acbeb08", "comment": "Malware payload (ValleyRAT)", "value": "71aab4d8dcc18cc41d2b830cae5d69db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776958952, "uuid": "7ea667f6-528f-4919-8780-4e777a6daf3d", "comment": "Malware payload (ValleyRAT)", "value": "06ad5c66f33f32ab0b3a6f2d6e3fcdfe700fd71103c0f9b97f0145f1dc5409e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776958952, "uuid": "4f59c156-10bf-4206-8aec-703db7c077f1", "comment": "Malware payload (ValleyRAT)", "value": "8897062c5dba378814b535e8675b818c07273781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776958952, "uuid": "1a985e16-ff95-48f2-9e22-e77cec0a48cb", "comment": "Malware payload (ValleyRAT)", "value": "20436611bfa3098e894c8bb17db64e1863a85abf9194ae3b1f309d152b94ef6981e6e04da86ac8e73aa16c90e290e367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776958952, "uuid": "0e754832-bef3-4c24-829d-a879f447c188", "value": "T196E533182B9290DEEE0444F629F72404F70103FDAC51EE591BA99983DF151BE4FA72DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776958952, "uuid": "1af23492-b82a-4f9e-aac7-f1db272a5b0f", "value": "ed52c9f1202d1769494680ae08ab4000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776958952, "uuid": "fb5797b3-4d11-4dcb-9a94-544197079de5", "value": "98304:DSLW39LVkP4pvR+OFniHlunLt7bdAYXEs6hQVsnL:mK39LTpZ+OFnb1dAYr6hQVsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776958952, "uuid": "eb4e4f53-d7bd-43eb-9c5e-26fb3cd423f2", "value": 3181056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776958952, "uuid": "0933aa01-443b-45bc-b1d6-c957264f11b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776958952, "uuid": "75203e45-21aa-4edb-876f-8e070789f33c", "value": "protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24c380b-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938161, "uuid": "86aa9c65-2146-43e6-a6f1-d24d86697bd1", "comment": "Malware payload", "value": "630082e1b20c362963b9dda3bfffb2dc", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938161, "uuid": "ef091cf4-658c-4f70-bd19-67cba0a1415c", "comment": "Malware payload", "value": "077d49fa708f498969d7cdffe701eb64675baaa4968ded9bd97a4936dd56c21c", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938161, "uuid": "e479ea5c-28b8-4c1f-9a4f-a48b771fd6f8", "comment": "Malware payload", "value": "485536bbcbdef4391d87db35f48e22c0753f3c54", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938161, "uuid": "7d008897-6675-48bb-aa75-882fa1614f53", "comment": "Malware payload", "value": "d66b5f996674406d7e2876a517c79a9091f98cf26e2c7e72a6d6de893e52c7278ec93020cbc7ae64154625c8b3cda960", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938161, "uuid": "5726aefd-e1d9-4d59-81bd-cfdbd5940e21", "value": "T193721B16CEA63D06AB78EB5042DD04CA6F5C1FCD247214E9FC2CD6CD87B58A5C8F90A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938161, "uuid": "426b91f8-881f-4fbe-8634-04ce671c8bec", "value": "384:MnfUuTp04P0TiF71hBZajpdRKYIU2/BYtRfF7yoZ0hF3h9Ba+N6i:W04P0S1hjORPfF7yLL3Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938161, "uuid": "78ca50c9-bb0f-4067-b059-25c063e9093c", "value": 16311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938161, "uuid": "2dd63f94-8eed-41a7-a976-aba865443f69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938161, "uuid": "e528c689-f06b-4282-9da9-10e245272057", "value": "077d49fa708f498969d7cdffe701eb64675baaa4968ded9bd97a4936dd56c21c.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eea2dc-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926548, "uuid": "646c7b29-d619-4c8a-9912-f1d23a3fe2f1", "comment": "Malware payload (Mirai)", "value": "e32833321ae7c96b38332d05e7591d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926548, "uuid": "4b789449-86ad-461d-a681-a859bc61d672", "comment": "Malware payload (Mirai)", "value": "08ab2a6793db5049ce4880584ed6d699977bbf10ee59243d5405af30a4020cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926548, "uuid": "120ecce7-755d-4db2-b28b-029dfb9622ea", "comment": "Malware payload (Mirai)", "value": "2cd10433cb113a1caa20e319e1da39c9b4e0069f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926548, "uuid": "d39188a8-d6b6-479c-a430-d74368c326f3", "comment": "Malware payload (Mirai)", "value": "5bdca3ed8b8eb3ffc73cb4ac57376c9414da95b3bcb863638f419e8b2a450d89d235c6a5182f0cf933c7d3d86b55231b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926548, "uuid": "f0715807-0f90-4851-8d61-1bd7efd99219", "value": "T1EC343B45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926548, "uuid": "ef2fc0e0-e62a-4eaf-b67e-644e824d7ab4", "value": "6144:0go/jNgGzHzakeqacEp1d4n1trkbf9ihM/9+AU:0DhgSHzakeqacE3W1e0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926548, "uuid": "a3731758-afad-40b2-b9e5-69b7962a8c18", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926548, "uuid": "18183e3c-1a57-48ab-afe3-6886286b4fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926548, "uuid": "6cade4f6-37d0-41ed-8280-4f292fe375d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae6de1f-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924377, "uuid": "96004984-e193-45cb-8c69-75833a0d530b", "comment": "Malware payload (Mirai)", "value": "b118e834fec0ad48371f44db4bd9ecaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924377, "uuid": "ceac3341-0376-4f69-b3cf-028a1bad93f5", "comment": "Malware payload (Mirai)", "value": "08e93631f4155943f97de0bcce6e3944de64011f1dd3e0bdec976490bdd1f8de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924377, "uuid": "2802c32f-9550-46bc-9720-a8962c7588e7", "comment": "Malware payload (Mirai)", "value": "07410877487deec63d37d6919b97ead81f58a987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924377, "uuid": "5dd4cdca-5c0b-490d-a2a4-75a735c6dd2a", "comment": "Malware payload (Mirai)", "value": "d61fc4af2b4797d316eae008e0ad1bdac84d7e577fd355a1d1125acd26d3bdbbd3e52e6492bc7d782b379b9bab861f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924377, "uuid": "61845e83-a7bc-4e68-b4a5-0bbf55be47d3", "value": "T189B3C409BB610EFBE8ABDD3746E9170625CC642B22A93F357534D828F14B18B1AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924377, "uuid": "779825aa-e82c-40b3-b166-ce5e39706b73", "value": "1536:YT086zk9CpaST45coEkP5EZC4gN+P4MrZv9dizMdSZD6FWX3COc:Yo86zk9CF88kuh9diz4SUKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924377, "uuid": "f004c22b-17d6-4f12-b517-fe249db31da6", "value": 115548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924377, "uuid": "4a7e167d-2461-4181-8e14-e7be0c2a5bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924377, "uuid": "32349833-6674-4f32-8006-9bb1ffd4c324", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4146716e-3eec-11f1-a769-42010a9c0008", "comment": "Malware payload (Lazarus)", "timestamp": 1776931985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931985, "uuid": "f4f67661-1ed6-4526-bd6e-95f6805ca5d6", "comment": "Malware payload (Lazarus)", "value": "b28978c94cc8c2cbdbcc839c8e0a465c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931985, "uuid": "83056c94-3f39-4d86-9541-6b87a490e533", "comment": "Malware payload (Lazarus)", "value": "0908f2906e0d8a007ca37f0791866cd75e982baecf51e207b7e6b293831f9033", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931985, "uuid": "4fcee096-388d-4280-b8fc-4e5f9cb191d2", "comment": "Malware payload (Lazarus)", "value": "2a30e36c6d00f3c15f0c43d2afe098424299af54", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931985, "uuid": "01e60e56-9542-43bd-9bca-e3170f9c6035", "comment": "Malware payload (Lazarus)", "value": "9d09b41f1eae29df515cd4f8c1cf77cbfc98c621137f1d387a401da6c7c01208ea5692f803c95dccd4e26c664cb61c5b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931985, "uuid": "b8943ab6-dafd-4797-80af-41331765b348", "value": "T126D5F1211E7EDDECF5E352B79F121E19809F25A8C01827E835B4DD09B7CBE98A1447B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931985, "uuid": "f702222f-5145-41cd-8663-a8993bc558ff", "value": "49152:XnCF+GcrABvyjTtgghgILwN7STfYxG3Co+7vNgPjlyvoWxpQe:XnCcjhphvw1SgGOvybcQWnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931985, "uuid": "2f5a957a-870b-4b2e-b955-abc3fbf659ee", "value": 2854112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931985, "uuid": "2edf18b6-7a94-4cb4-8586-f17474258dd7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931985, "uuid": "8b95333d-2cd6-420f-91d7-ddcdb6afb788", "value": "0908f2906e0d8a007ca37f0791866cd75e982baecf51e207b7e6b293831f9033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2d1ff7-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987494, "uuid": "f50f047d-fa53-4968-93bb-c9b0b1c4ad94", "comment": "Malware payload", "value": "2cd3d09f4273de24839ac84bbd64c700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987494, "uuid": "f923e1f0-b0e6-4d59-9c2b-4afbcd734be3", "comment": "Malware payload", "value": "0918a30e778d927e6b8a6f48f891c99d34c39c37424672b7301ab32ab74b7cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987494, "uuid": "5b1b7630-fb71-4373-974b-15739e2ce1ee", "comment": "Malware payload", "value": "8665c135730132eeb0c11849f8347b82a0ac8083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987494, "uuid": "9ab9e8f2-edae-4c54-befe-8bfec6f2f855", "comment": "Malware payload", "value": "62a2507d3460745b3c73f1c4c07291a77bb9802fb2b247f5422f41420f366835f27c1554942d5362f46ef0f1182c8bd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987494, "uuid": "bfe97b4c-18b9-465e-a708-e0948edfbf70", "value": "T126E2F1FF930184B4CEA6A6BB27FD1D1B578D55A2C7261C08C7C566CB2A7D90A06BF030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987494, "uuid": "24972f9e-08f5-4124-a741-2f1f558d3556", "value": "768:vWipXfnPHNbEN128DCn16wnSwhAU7J59NVZdWvwv1w:vWipXfFYCX1ZnkmJXm4vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987494, "uuid": "909ff4bc-762b-442f-b3c5-219653221e36", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987494, "uuid": "71119cae-9b68-4df3-a81f-cb41f1748e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987494, "uuid": "757def21-b6c8-4a75-9be1-f45bb4aac19b", "value": "0918a30e778d927e6b8a6f48f891c99d34c39c37424672b7301ab32ab74b7cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271ae166-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982192, "uuid": "a94adcaa-d272-4b28-be82-79743834c8f8", "comment": "Malware payload (Mirai)", "value": "b9ae1cb9faecd03f2bf63bf7e60b5145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982192, "uuid": "54f1b64b-0616-429b-9d6d-23f559150cbc", "comment": "Malware payload (Mirai)", "value": "09213ecaabe32c8322ccde114f544ffc69efa615707a60b6c76269d5b2cd3296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982192, "uuid": "38bb1283-6b51-4c5f-bf45-c28b40ab3356", "comment": "Malware payload (Mirai)", "value": "61c2a31a6ff2b5a4c26ec5a13250f57c4a0767a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982192, "uuid": "c9b3566b-4f6d-4000-8e4e-6a450cd4d45f", "comment": "Malware payload (Mirai)", "value": "2210f4c9a484d24d79386bd8c50198d8a8c704b5dd49bee8e9e65d62e820d3b8400ec75a5331fc58aa900d18d4c17915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982192, "uuid": "f46928df-79ec-4b11-85b1-afaf36ff995e", "value": "T137D30A56F8819B12D5C111BAFE0E124E37131B78E3DE7302AD246F747B8A97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982192, "uuid": "11be7b61-70e9-4ba8-bd34-f08dfc61d178", "value": "3072:UAUg6+4WXrdM2gUa5RhBc/b6FCAU3CR5nK:UA7CWXZM2JaDfFdU3CRZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982192, "uuid": "62f94f75-f63d-46f0-a29a-70bd76e5e892", "value": 138044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982192, "uuid": "40798212-8a5f-49e7-927d-0bd8b1471f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982192, "uuid": "c7ce53d6-3644-4310-9983-5cf43d4b87bb", "value": "concakhbtandhuy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1b1c9e-3edb-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776925002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925002, "uuid": "6805808e-3b4c-4c01-95b1-2092fd787eab", "comment": "Malware payload (Koadic)", "value": "635bbf13d3fc68ae1996d1d3d73cfbb1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925002, "uuid": "03334d06-acbc-4c7d-94eb-6a4ef7115861", "comment": "Malware payload (Koadic)", "value": "0af9a5741d1545cb81824214692e1d3858a0e2e85342f061655cd0c17cd9d87a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925002, "uuid": "bddf48c4-dde0-41ee-98a1-12d5d5f3e5e8", "comment": "Malware payload (Koadic)", "value": "b9152aadbedcf4284363832ff8f8d87756d5f1b3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925002, "uuid": "961e6bf3-0af6-4532-8370-2c0d87110c7f", "comment": "Malware payload (Koadic)", "value": "c0b0941b07479e2d8c4ad7f05d1164ae58ddb5b7cfd29abde001035d6de74f4991eb454da4cc88c5f9b9122696f72306", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925002, "uuid": "145a7ed3-69b7-48b1-bd6a-9b6634deb022", "value": "T121A2D0138ED307BE7697C637664DC0915A46FD2E9371F3B7E801F1FA286909C94822AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925002, "uuid": "9018ac02-04b1-42eb-b993-5472cad140d7", "value": "192:lXp2V+r5zfqkFQ3Zir1Zk5N/eZtYeeT1pNA3l1NX8icYj3kbdRjM+E5Oa0aN6aeU:GKK0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925002, "uuid": "ce941ae4-e0ec-467c-be5e-d53f38a5a13f", "value": 23005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925002, "uuid": "440c6dbf-5a9b-483b-9e64-8ed4592138f5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925002, "uuid": "b4cce20f-861a-448b-817b-13ee3634a79c", "value": "Vessel_main_specifications_Q88.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467e9d41-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928128, "uuid": "5790c0ac-ec3f-4e08-b63c-f4d5d37639cf", "comment": "Malware payload", "value": "1639226a682e9ec5f75fc30ca89f5847", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928128, "uuid": "2b9d89f3-2686-4b59-bb9a-3bf1ef198543", "comment": "Malware payload", "value": "0b8bd478d4ca2bcf92ee11621de72447806834527ec28c147b79334ba7a0e962", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928128, "uuid": "9c8bb625-eb25-4621-ac17-c3408e55659c", "comment": "Malware payload", "value": "d34ae8e3fd7b23324f642d40e4501388a958b6d2", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928128, "uuid": "75ed1164-c000-4e8a-8fc0-a44e3a54ece5", "comment": "Malware payload", "value": "b361685f06f7fd1ca6f454d65537cafbba4e70e86a8e37a0b3a18793bcc47ba4e227cb869d3d1bc327351949d9daa115", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928128, "uuid": "ae2106f2-fec5-4f88-86a1-d444071df658", "value": "T1E037230BEC1D86694F54ECAC11BF3FCA3E905D881A298DE54BE0B4C7BEE9F552A17140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928128, "uuid": "d8bf9c92-3a0a-4387-b58f-379036ab4b3f", "value": "24576:CCzCPC4CWCXCBCTC0COCdCCCE2Ia5hwMlCsnVCLCFCACGCBCL2Ia5hwMlCsnVCK5:sIVIuIcIaINIJIOI3IrIcI8I6IHIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928128, "uuid": "0e66143a-ee17-4fed-946e-813695a01cdc", "value": 23051586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928128, "uuid": "00207f05-a4dc-4356-a761-edc77d8f3f77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928128, "uuid": "2b0b5c89-e5e1-48fb-befd-6e825973af69", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40b60e3-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944284, "uuid": "ccf2921a-897b-4c7f-b642-5ce3a5d91e44", "comment": "Malware payload", "value": "9242b49e9581fa7f2100bd9ad4385e8c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944284, "uuid": "1ae45058-263b-475d-b153-fae3bfe72e3e", "comment": "Malware payload", "value": "0b9df542755298cd0b087681efbfaf91d35209966ff3bd8368ba65bcc0536a59", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944284, "uuid": "fba3aeeb-105e-4525-8b3c-22fe1b87fafc", "comment": "Malware payload", "value": "83f4f062b50d8710062d750dc0e1788157ede761", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944284, "uuid": "647815e3-5b9f-4ceb-bed6-48c4908f7ff7", "comment": "Malware payload", "value": "f99f89e7c1115d3ad7e246c4ad406ac89cea06faaeb8c563089b23d111c828eca4f1f7276594738144025b84206f38a4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944284, "uuid": "4155529c-cea0-4bd9-a3cc-23ef5e3ee5c2", "value": "T165416521BF38B77CFBD8756CD9E31909161E0E14091874E8FA59C04F12DB34C8669AAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944284, "uuid": "3a02ae0f-c682-43b8-92a3-9aa3f13fd662", "value": "48:6VoHsscPPcJ2HbebVPWShWjU76nGe1K/cpERHFm:Hr27eb4ScjO6np1tpERlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944284, "uuid": "95c95652-c61e-485c-b984-5ed6fb52f1b0", "value": 2300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944284, "uuid": "e988835e-b2fe-400e-a472-e83800218a60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944284, "uuid": "39c0781a-39ab-4302-9305-4db01c5e0267", "value": "0b9df542755298cd0b087681efbfaf91d35209966ff3bd8368ba65bcc0536a59.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8619ee6b-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923081, "uuid": "45b7c851-58ee-4055-8ad6-123d0636d07b", "comment": "Malware payload (Mirai)", "value": "7bf7c1beb093ee234050c1d3740d7816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923081, "uuid": "5be6ea4f-7f12-4e11-ab58-6d13bd7fc5cf", "comment": "Malware payload (Mirai)", "value": "0ba4e1cdaf70b03e78d664ab4ccafd02c4e77e060c4be32d9fb08049d2267086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923081, "uuid": "2872234a-8a5e-4c80-9f3a-c5a121096323", "comment": "Malware payload (Mirai)", "value": "238d2fded6574592b99adffc0e849212c7efec58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923081, "uuid": "45be4f44-7d3c-4959-86f5-a7fe9835f6ba", "comment": "Malware payload (Mirai)", "value": "3ee3aaffe2d5f2d3fd12f5a57d7bd449bc81a1068d4dec1bf8c23cbf66cb4bdd6ce4f3a8bab2f4ddcd17850ec9d2db2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923081, "uuid": "ea649279-b5a3-42f9-b856-12cb4096eaf4", "value": "T1E2537D523F324E90DA2BD17149A7CA656FB029856CF282C773A0D71CAE3D7580C1BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923081, "uuid": "476b4452-e08e-4371-8119-80fc36486a5c", "value": "384:cnunebxIBKBFXbtAXIQz+tYWqCrRkCx0LaDdHRBfAptibEB+RpKsbDMd:c8ew4ru4XYxCr50uDdbfs8UkDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923081, "uuid": "eb048600-9f92-4fb2-901f-37b96f5037a7", "value": 66584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923081, "uuid": "5d3f7b7f-670c-4bf7-9683-3caf13354e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923081, "uuid": "04015c61-17ce-477c-85ab-dc68f3c9036b", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfe3598-3eef-11f1-a769-42010a9c0008", "comment": "Malware payload (Allaple)", "timestamp": 1776933320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933320, "uuid": "b16760fe-baab-4e5d-87dc-37f367e10735", "comment": "Malware payload (Allaple)", "value": "f3e10252429dea3a231d30c620079f89", "object_relation": "md5", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933320, "uuid": "554bea1b-6098-4cdd-839a-5184ec00f4fe", "comment": "Malware payload (Allaple)", "value": "0c345fc931b8e7e4e47e7f0e9b2073d41cb1f019bff9950bb250897165015d76", "object_relation": "sha256", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933320, "uuid": "1cd1d3aa-7f26-47d2-b8cd-71aed915731c", "comment": "Malware payload (Allaple)", "value": "16765b8583608f2dba57ddcbf19db5e6974f3b7c", "object_relation": "sha1", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933320, "uuid": "152a0137-3e60-4311-a6bf-c45c00f333e7", "comment": "Malware payload (Allaple)", "value": "d715d85e458bd60139c10f4c7937bc3b6791e3b549fcb403edfad13778bd27c184a893b928a0591ca79011e60662db73", "object_relation": "sha3-384", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "allaple", "colour": "#A939FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933320, "uuid": "37acda62-9530-4969-bd05-26929be1e045", "value": "T157B4027843239573CB460C710D7223BA5FA91E3E5E38D307D6905E8A396C5A8FE92397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933320, "uuid": "5c797f7f-4fdb-4263-bf65-f640243ea569", "value": "9b5afb31df8913df8356dc35d83c9a63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933320, "uuid": "c4ec3f7a-04c2-4ae4-aa7d-bd1f8710287f", "value": "6144:YAzcyHH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uTs6gnx77iZ73vnZi2:Yc2EB0NxDIBuOFe7/uTsYzPZi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933320, "uuid": "16abdb75-15be-41b1-85b9-b25a0fe3ca58", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933320, "uuid": "4dce5152-406f-41c8-9823-33b08668894c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933320, "uuid": "35ecc0c7-f261-4ece-a259-17bcabb8ab98", "value": "0c345fc931b8e7e4e47e7f0e9b2073d41cb1f019bff9950bb250897165015d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3eccfa-3efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Spyder)", "timestamp": 1776938986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938986, "uuid": "ac580c2a-5d03-4acf-bc97-339ef90363d2", "comment": "Malware payload (Spyder)", "value": "3f4221dacc105466932db94b9b210b84", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938986, "uuid": "105a0b64-d721-48ec-95a7-6924ad9da190", "comment": "Malware payload (Spyder)", "value": "0c69637c2f54822a2f6c796a7800192474742d6f309b3d6aa82ecb10690a7097", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938986, "uuid": "7804dc46-5166-416e-b38a-e811c262fff4", "comment": "Malware payload (Spyder)", "value": "7e75a8b3c40d8dc722dd8264a270df6230bef792", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938986, "uuid": "65d07274-e7e6-4535-b84e-61b4bfa395dc", "comment": "Malware payload (Spyder)", "value": "a46e44eb8cba55b7d6b5ae211acbb4747ff5fc39fbbb3158c6fd21f77e0eab6b24acfff5d822d9ff4b6c81d4ebfeee6f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938986, "uuid": "a759ca05-21dc-4753-bc63-917cd80e774a", "value": "T1F0058D12B5C1C072E6A202714969F779967EBC314B71FAC7A3C06B6EAA301C25F31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938986, "uuid": "688f7969-6625-4475-b5b1-17b554efbc04", "value": "6b3faef0d34e9e915ce499be66006797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938986, "uuid": "49d86153-43dc-42c0-bd61-032501cb9540", "value": "12288:6aiJKWXpeuk0mrvyBFt7GANYiX9O23JeVcG3kK3bNZ1QRpfzJ75M2tmvJ:KJKOc+BFtZNYiX9OYegK3bVQ7LJ1QvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938986, "uuid": "dbadf288-ef26-4ad6-bd8a-fb5459bc4450", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938986, "uuid": "50593c4e-4ea4-4d54-96a7-cf6702e5643a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938986, "uuid": "25a841b9-91a4-4b52-98ee-bb28f0349c13", "value": "0c69637c2f54822a2f6c796a7800192474742d6f309b3d6aa82ecb10690a7097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee5e998-3ed4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776921888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921888, "uuid": "cf2eb209-aaf8-437f-aada-352ea6887905", "comment": "Malware payload (Mirai)", "value": "13f04e37cce9774fec4375bb32d4ba4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921888, "uuid": "ac2701b4-15ef-4de1-8813-a3fb29546412", "comment": "Malware payload (Mirai)", "value": "0ca513a03941e73ccc2b94c6a035f7673dcde57e35c6cece1734af87891a1c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921888, "uuid": "644ff46f-9092-4944-8c0d-83ccb6391292", "comment": "Malware payload (Mirai)", "value": "d14633a913cf47b3355a075fc846e9fdb73b8e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921888, "uuid": "b3a2c7a7-e9fc-4b5d-988a-287dc282058a", "comment": "Malware payload (Mirai)", "value": "33a27078e0ac57444a030d766b99527d36b1a2e017464ff116d0ed4fe62738507265e1e6f6bc1996dfeebca1e238fcf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921888, "uuid": "734448ee-d649-4f2f-b6c8-fde29bac8f99", "value": "T170336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921888, "uuid": "4f1e3eec-1b7f-4cdd-8583-25c226e01d2a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776921888, "uuid": "5538e2c6-7e30-443f-ba37-d751348c5e76", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776921888, "uuid": "f4b4ebc0-44cb-4c08-96bb-424aba053092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921888, "uuid": "3b261b22-9b75-4938-a1ca-59806aee107c", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59784b00-3ead-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776904967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776904967, "uuid": "e36cf9e2-1488-47f8-a045-512554e1492e", "comment": "Malware payload (RustyStealer)", "value": "17c3e8d77fecc6437278373b6917a166", "object_relation": "md5", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776904967, "uuid": "83cb0f41-c87e-47ea-98ea-216ef807ec17", "comment": "Malware payload (RustyStealer)", "value": "0ccbcff725aa0de1c94de06335c03c0c0163935ced9b326962dcfc9f14ec7235", "object_relation": "sha256", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776904967, "uuid": "e7239497-a7cc-4f58-b9d6-e9e84cf027f2", "comment": "Malware payload (RustyStealer)", "value": "c24408e5d25e55fd6c9f71a59ea1f4068eed13bd", "object_relation": "sha1", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776904967, "uuid": "486b9e93-2d41-414f-95f9-39e7199a7c7c", "comment": "Malware payload (RustyStealer)", "value": "d050f87cd61db241b9c3ac010913cc1e7fa3d4ff54c3daa6faf9fdd625f8f8f0a4116e215ae3dfb9ac99cb7b39f3b9bc", "object_relation": "sha3-384", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776904967, "uuid": "ea0969e3-9df5-47da-b446-947a1470fbf7", "value": "T149D66C036F9A48E9C499C8B4C3578B634E2234CB1A36F6AF45C501293F6EBB55F2D319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776904967, "uuid": "e1f90552-35ff-4db5-92e7-8d48c8940f3f", "value": "190ea639bd15444702fce256ae62c1be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776904967, "uuid": "fd43d621-e59c-4f69-af26-484f83ded42f", "value": "98304:hVEL7aLMEkh5J5wVn/wgTygJcKdjrEmUwQXn+wMLmzn+pfr2:hK7pEYwmgTD6KdbQXOL+Yfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776904967, "uuid": "8ada7be1-8e73-4930-89bd-c4682bf01420", "value": 13238272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776904967, "uuid": "8b1d2e63-4398-4a65-bb41-d5570c325ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776904967, "uuid": "5b880286-9647-4c99-88a1-ccadc809dea3", "value": "nexus-agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914bbead-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927824, "uuid": "6b976187-64b4-4027-9b0f-28ce653e1960", "comment": "Malware payload", "value": "76ab576099be57803a2a0323337ddc29", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927824, "uuid": "92bc43be-0e31-4748-86e4-1b1ce98cda17", "comment": "Malware payload", "value": "0d2d8e4797617217d7fa330c64bf933f9b2ae530e318fc3f9275e6f04725109c", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927824, "uuid": "25b4d898-e787-45aa-827f-8bd8f23edf6d", "comment": "Malware payload", "value": "c380b9132bed6d3b25d7536675f717621a2e125a", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927824, "uuid": "cd969cab-4c9d-4e7e-b50c-a585d61c6155", "comment": "Malware payload", "value": "85667a70b4497d5189a7b174d469385e88c447c1ac6d8825fe726dae4dda4d74dcf9875e095e4b6a7147bda6ec9f22bc", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927824, "uuid": "ed1e9b96-c805-4105-a72a-217d44874ce8", "value": "T14D272347A6591F7F0F7A917A109F0F2B977CBA48D1B0DAE8558302B78B69732087247C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927824, "uuid": "2450a018-4e73-45b9-8ed6-2a79f691a02e", "value": "49152:PPQiPQcPQSPQmPQDPQlPQEPQRPQgPQKPQbPQgUZrTPQ/PQXPQ+PQLPQEUZrkPQJo:Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927824, "uuid": "f2187258-56b6-493e-8354-14e9c1f6545b", "value": 22331558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927824, "uuid": "65122550-e2f4-43c1-85b6-169c1b55ef29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927824, "uuid": "78911174-75c2-41c7-a5a8-5d23b4805de7", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2fa2f7-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1776930767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930767, "uuid": "8c331524-e6dd-4ff2-80ee-1f55507cf141", "comment": "Malware payload (QuirkyLoader)", "value": "cb2f852a228e58cb06e0c9de77dd062c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930767, "uuid": "6e537ae3-def9-4e04-a835-f7820fafe300", "comment": "Malware payload (QuirkyLoader)", "value": "0e2ed4f70e4f8ec89411a08b49318c18fd03ead33b10a6117052ef672c62f030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930767, "uuid": "79fabba4-c87f-4bf9-88ff-26287f569634", "comment": "Malware payload (QuirkyLoader)", "value": "430fccbdfe053d35f66ee5c8c79961a5b94151f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930767, "uuid": "a6115e69-4342-46ea-9ac7-3ee418413f5c", "comment": "Malware payload (QuirkyLoader)", "value": "b15685cf4c927ebd62167f4c4e5da4eefa952f66318dc2a13025849278a397af6582ff46b20649d2310de8ad1a491131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930767, "uuid": "e712f782-af9c-4d85-8e04-949915c0e0a0", "value": "T126359F19E3C826ACD527C574CBA2A232E2B5B4560761B9CF0B5AC2153F73ED06B7E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930767, "uuid": "e7c4cbf4-e2e1-4582-978d-be577d31b887", "value": "69dd7f2291cc432e1dd9a407658776bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930767, "uuid": "6695ce2d-c6d8-4156-bc08-4f3aef6a2dcf", "value": "24576:1+cB7wM9S0obOAXjd1plcHFfF1mDOxlQ6RxM6zn8gL:1+cBhW1PcpCO46RxM6zn5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930767, "uuid": "add89ef2-cefe-4ce5-a81c-690acfd78d16", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930767, "uuid": "6ec565cd-4f70-4ee1-8d09-a0005e59c28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930767, "uuid": "cf05d580-6bf1-4571-b827-594010c5a399", "value": "msedge_elf_3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e5d2c0-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935051, "uuid": "9cfc1f41-01bc-4b86-8a6d-fbeaae30095e", "comment": "Malware payload", "value": "34a9b024da31c3c54233f7da2021ef8a", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935051, "uuid": "c7387d30-48d9-4565-a34a-5531da3be670", "comment": "Malware payload", "value": "0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935051, "uuid": "5b18f1fa-8ca6-4bbf-a341-c6132c905011", "comment": "Malware payload", "value": "e11cc0e79307a6237a6660d48988402fad6d3c6a", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935051, "uuid": "3308bc27-a4c1-4ac0-a6b1-2d0db7ad8d70", "comment": "Malware payload", "value": "cc5dd7a6bff5b731cb95d038df82f6e2435edd0339ce11f6373544b14cf48f8fb7c0e57bb0df02c0813ba83cb7a55c2a", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935051, "uuid": "f655c0a1-563a-43a0-9aca-e14fbe774cc5", "value": "T13FD46E347A011EFF5BB820C248C6811C563832B8D9686CF5AACB5CE33A1D77617B79B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935051, "uuid": "c55f8934-7d9b-4258-ae11-5997f2f9cd67", "value": "12288:MwRBk3+Gh90P4w2BA2MT5raa4LC9M8RNH:MkkO5b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935051, "uuid": "756a4f6f-16f4-49d0-8e9e-5e6e2545eb89", "value": 599360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935051, "uuid": "86dfb8cd-fe30-4004-9016-2a9f47a3a314", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935051, "uuid": "8dcac7f7-7dd5-4307-8578-0ef05b6bbc9a", "value": "0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cac7dd-3f52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976103, "uuid": "bd588b9d-e86e-466c-b488-76422f333c29", "comment": "Malware payload (Mirai)", "value": "517d6c918c56c764339c0776ab82dfe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976103, "uuid": "d5198506-f103-42c4-82ed-c7f75e413241", "comment": "Malware payload (Mirai)", "value": "0ec3fc2bd212af4818e08aef2c6b0ab5517f613b01c321a007f8c4cd621683ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976103, "uuid": "dc982aee-e34f-4553-be13-de6aa5832d2d", "comment": "Malware payload (Mirai)", "value": "571879aa5db362a379489de1147d283d93133349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976103, "uuid": "88b24d32-0d4a-4ce9-bc21-b6087de0e877", "comment": "Malware payload (Mirai)", "value": "1ab2c15096af6760af747e857a230162222903d8dddc5218a31f4127f82be5659edb8a90676b327d304f8ab8355c1147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976103, "uuid": "47fc070a-7b8a-4075-88e3-1ec619c1686a", "value": "T1E5D31A45F9415F23C6D622BBFB4E428D3B2A17E8D2EE7203D9255F21378785B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976103, "uuid": "8929800c-8e07-4835-9adc-c36440def1c5", "value": "3072:hSwEoioOSmm9VCxH/4ziAhm1P1wWVC/Y:hSbmcH/4zJhmx1xVC/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976103, "uuid": "36ce749a-9ed7-4d67-bd90-b372b02b40fe", "value": 138048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976103, "uuid": "0a84511b-7dff-49c7-86d1-e7a1baca4165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976103, "uuid": "9368f4d8-b7e2-4a18-8c66-a23086ae2c01", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61913ce-3eec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776932261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932261, "uuid": "aa6a4125-80f0-40bc-804e-e8a1dbd948a7", "comment": "Malware payload", "value": "113bc71ffba56a2d6a661ae93ebe2546", "object_relation": "md5", "Tag": [ { "name": "144-172-114-220", "colour": "#3A1C49", "exportable": true, "hide_tag": false }, { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932261, "uuid": "6123a346-c242-41ad-a581-2c1dd752a018", "comment": "Malware payload", "value": "0ed9a9b7923df0bad0be9ac7fe8ecb6a669715823f892d034b8d07ce9e0aa164", "object_relation": "sha256", "Tag": [ { "name": "144-172-114-220", "colour": "#3A1C49", "exportable": true, "hide_tag": false }, { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932261, "uuid": "d9bbcc25-aa56-485c-b19d-a53e491271ff", "comment": "Malware payload", "value": "18240053f38e2cbd550418fa8afaa9208fb0f9fe", "object_relation": "sha1", "Tag": [ { "name": "144-172-114-220", "colour": "#3A1C49", "exportable": true, "hide_tag": false }, { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932261, "uuid": "0bb21ae3-ddbc-4dbb-9b1a-b44d2b569133", "comment": "Malware payload", "value": "154daa22976a055971dbfff3d5e221fd9f6ec798ce4898a74d4199bf30b8ba205583a6cf47cdb3fdccd694d86f70014d", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-114-220", "colour": "#3A1C49", "exportable": true, "hide_tag": false }, { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932261, "uuid": "fe2aa0a4-0738-414c-9558-d4179b0cdade", "value": "T1A3F09E325D5442D1C6B48AF07C60DA1AAF1FE42E0D1B6D3D41FC26503962BFDA6EAD88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932261, "uuid": "b850cf68-e843-4332-b429-0510d72c2ae0", "value": "12:yGIXRLcY+zIWaWzTu5dsHBysaR0MndTTFRWGXRLcQMndTTFRWGXRLcDku1G:fI9cJQd6BSjdPbWG9cvdPbWG9cDkuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776932261, "uuid": "817b2449-7869-461c-9b55-6360876fa303", "value": 505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776932261, "uuid": "8a0ebc73-3275-4762-ad1f-4ba745faf8b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932261, "uuid": "0b1f61b1-bd6c-4140-8afb-a9923e6cab2a", "value": "0ed9a9b7923df0bad0be9ac7fe8ecb6a669715823f892d034b8d07ce9e0aa164.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199a2c74-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985605, "uuid": "3c2c750f-51cd-4ee3-bf5a-64c803900ab5", "comment": "Malware payload", "value": "5138f4e662fb8abbec1af89561933e0b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985605, "uuid": "9d24aa2c-48a0-4115-8f26-2f7e957e7826", "comment": "Malware payload", "value": "0ee4884dfdabb081b394ce074fbe0dd408056ca7616694bdba188ac6db50a1e2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985605, "uuid": "9c62f186-bcdd-47de-87d6-135fb6f5395a", "comment": "Malware payload", "value": "bb371eb29e1ed18a657d2fe7dcf97fb102759a09", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985605, "uuid": "b29eb8b4-5e25-466c-8c03-c0cb980a4555", "comment": "Malware payload", "value": "9b9304ead85c0990c3e1a00400a5f537b1142c5031490beb8e2ab168156a0cbb455acde0468b5ffe562fcc80fb2b6a0d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985605, "uuid": "80ebb10b-093c-4b62-968f-27865567981f", "value": "T1DEB3123150D484E49E95CAB2A5C21AB49887117E98FE37277504F860EA3FEC619EF633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985605, "uuid": "869bc581-3848-4b67-8a1c-042965c7151d", "value": "3072:2t+uyXYVja+QRhV9kzmKEVMtxhK6y8wQVTuL8NWvrGvSVLz6eP15rR:syIVZQRhnW1yM0QVI8BvSVL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985605, "uuid": "9bf6e282-ea00-4bc1-b251-7ca0cee3d1eb", "value": 108437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985605, "uuid": "c8c7b479-a3be-4b3b-a8a5-3809d1158e41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985605, "uuid": "26fa9f36-f18a-4ce6-8718-0f931a10a468", "value": "occasion.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f520fffc-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968364, "uuid": "6f8f5d35-076d-47f8-a36b-2912dbac06ae", "comment": "Malware payload", "value": "424a1228a30919f650eab93105c86b18", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968364, "uuid": "7e723820-5c66-46a8-b76e-2c991d000ae3", "comment": "Malware payload", "value": "0ef295b8e4eeb1374d44f9fcf68e28815a7ec8eabb22e3d3ddb5b20d9dc1f4dd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968364, "uuid": "f83e0c93-3cf0-4c7a-a41c-de85585afa6d", "comment": "Malware payload", "value": "1237370a02f8fef9d65c23233e0ec9d143add3d7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968364, "uuid": "512451a3-f8d1-4f01-8469-e5c0b92754e9", "comment": "Malware payload", "value": "0189bfba53953dfcbfc1f45ca6f85002f437a2129aae1d158ae52543d75fb690cb530389c5bfa1dce3bb887451c0b896", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968364, "uuid": "b2fa0018-5275-44b6-badb-392529678427", "value": "T15106F186FF19952FC87700360FAA837532668D128E829B477958372C6C77ADC0F59BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968364, "uuid": "d4571115-35e6-4f62-bda6-f46dc40cbb6b", "value": "98304:EIa28Jr76B0O7g0j9sfbybgth8JWKfTJ3+MEr:fcA0O7g0poco2HEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968364, "uuid": "b6dceba9-ccbd-4480-8903-eb4817123605", "value": 3948369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968364, "uuid": "dbf72f91-1b04-4f32-a1e2-3d3d534773f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968364, "uuid": "1d91e8e9-11fe-40ba-8875-4df38b5605b9", "value": "0ef295b8e4eeb1374d44f9fcf68e28815a7ec8eabb22e3d3ddb5b20d9dc1f4dd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c88f64-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928023, "uuid": "96428223-d9ef-4b8a-b871-9fac38761e41", "comment": "Malware payload", "value": "3fd56b30edd20bef2fa3fa6c836f4d19", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928023, "uuid": "1aa2b871-2759-400e-a454-8a4749ac97fb", "comment": "Malware payload", "value": "0f13f15a0bfde0be9cd616696a9712894c46c2163cce82729006300d7293a644", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928023, "uuid": "8100535e-c642-49d4-bf6b-997024c93842", "comment": "Malware payload", "value": "c209716a84b3f1a1bd5d9e3d35bc860d78ebed96", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928023, "uuid": "84c7b368-6045-4468-aa45-f87b647f9d51", "comment": "Malware payload", "value": "087a73be38676e291a83044092de116ff427987c77fc375162a86cce08e350bea744f9ae519c3821ff75b05104114500", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928023, "uuid": "1c5dfeff-2fa8-40e3-816b-856378f9aba4", "value": "T182272367566DDB6E89B837BC8078158C31D99EE0809233F695F2BC3E56CFE0A085F449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928023, "uuid": "8d9ee30e-7481-4b54-81e7-0a43dcd42aba", "value": "49152:wW4ZIXZiW4ZIXZlW4ZIXZWW4ZIXZFW4ZIXZrW4ZIXZdW4ZIXZLW4ZIXZeW4ZIXZ5:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928023, "uuid": "c974bdd0-1c04-4ba6-a14d-63d7b815b01f", "value": 21851513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928023, "uuid": "7edb7e6f-1d8a-4f5c-b44e-6d0d3ccd0f2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928023, "uuid": "0b7dc84f-2c06-4807-a4cf-ec1414ca9864", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c79d65-3eef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776933340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933340, "uuid": "2c8a0b89-c204-4336-a00a-e060fbe611e0", "comment": "Malware payload", "value": "24052d0865d5db6f9943f7430df550fd", "object_relation": "md5", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933340, "uuid": "724a0446-02c5-40fb-97fe-9a8f179a2005", "comment": "Malware payload", "value": "0f1e11046b55fbbd774f5bd2b18eefeb63221734615c244c7790d384b88d56c5", "object_relation": "sha256", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933340, "uuid": "3d015c12-168f-4761-9435-3c315717a780", "comment": "Malware payload", "value": "0c74ae1ed95eab50897d2801b31e9ec95d1713d8", "object_relation": "sha1", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933340, "uuid": "e5b6febe-b2a4-48c2-9cda-d41be1f89a02", "comment": "Malware payload", "value": "18d8122e226d7f6ce9dacb9c6212f937ee48e0c6026a75f8bba5c562dafabb0a7f4989bd346f9424a7373d7a29591e8c", "object_relation": "sha3-384", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933340, "uuid": "5f47dbc8-d19c-4312-a83f-8dc3b2f78eb4", "value": "T16CB296519BFC0196F6BB8B39CDB58051AA767DD1AD36C20D0261812F0EB0E91DD78B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933340, "uuid": "4ef18cd8-f0c1-4c11-81c1-05ab10509bbb", "value": "23072d6044b41f57bbc25d18fe8a549b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933340, "uuid": "15d22eaa-bc8d-44d3-b345-35d03c3875c5", "value": "384:GJV/Q4JYyYpleF/Rmocs116kckhPcVRP:GTpLJ9AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933340, "uuid": "bd79ed45-bd0d-4114-8030-55d90462ea57", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933340, "uuid": "80cd2458-7526-4ca8-80c0-4639b3cd9a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933340, "uuid": "09630fa2-1a04-49fe-b0d5-7d6eec15900f", "value": "0f1e11046b55fbbd774f5bd2b18eefeb63221734615c244c7790d384b88d56c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49e50a6-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968283, "uuid": "a761643b-0cbe-4626-86fc-0de763453cd5", "comment": "Malware payload", "value": "5047e66b7c508e96db93bcbc754877cb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968283, "uuid": "a689d899-963c-43ca-8c31-8cb47eb3d35d", "comment": "Malware payload", "value": "0fe1d40300ed1974391f9d4e15d5f0c95119c11160d096d6571efff8119bf072", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968283, "uuid": "81e2119e-5718-4dfe-8694-b9bf9ef20a37", "comment": "Malware payload", "value": "2d4ffcb06ec92a0f0c56156de0c8c0cd1d50f0e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968283, "uuid": "3548696a-1bc9-487d-8d94-7437e4371349", "comment": "Malware payload", "value": "0a320948b83d02d36981c906d359d48030dcdb615383e8e281ccefdc457a863f24b00f996d3dea48434aae47b0b60fa6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968283, "uuid": "4a39a14e-a92d-4e15-a6b6-16cbfaf14cc0", "value": "T1B0160186FF48953FC87700324FAA837536569D128E829B47A958332C6C77ADC0F59BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968283, "uuid": "1a42268f-b182-40d0-975c-e5200215e432", "value": "98304:aNVTF8rWS3/SaV98CHUJSxLUm1h8JWn63dJ3+GEw:E216DC0Jc5cbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968283, "uuid": "515e9299-b7ce-467a-89ef-2605037e5e7e", "value": 4221521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968283, "uuid": "bb2179b2-fcb4-4ee0-b195-6e01cd8dc906", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968283, "uuid": "86b1bc02-a8ef-4787-bc0c-321adb8ee934", "value": "0fe1d40300ed1974391f9d4e15d5f0c95119c11160d096d6571efff8119bf072.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdbd165-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976187, "uuid": "586179ed-9ee0-4dea-b0b8-2f98ea6b6c23", "comment": "Malware payload (Mirai)", "value": "ac37e99f50f0d13aa6970e60ecb6915f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976187, "uuid": "60d567ae-2841-4f47-a1e9-5f0f6b5e133e", "comment": "Malware payload (Mirai)", "value": "0fe350decb256b062c281009d628a21db7ea7a2af94609f1c9687faece8a6dda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976187, "uuid": "6c5aa6ff-9aa7-4083-b441-b41e3a768e69", "comment": "Malware payload (Mirai)", "value": "456d77de0078e3f90c180d5118dd6c6798ae618f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976187, "uuid": "1f8548a5-a904-4432-9dac-0d17f3ce7061", "comment": "Malware payload (Mirai)", "value": "e19849c4b1dc4e21834d28f693917941d0f3d0ca5da787e4d6ddc812558cb7c71d33efb1219a017c04967a3844552b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976187, "uuid": "98d30a13-9f54-41a6-826a-0b05980c8027", "value": "T1C873C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976187, "uuid": "7796a4bc-9d37-452c-8e44-ca2806aec297", "value": "1536:bpxe5qoct9fdlQBI6rfEnUFndlBotYG9CJa101Dv:Fx3oANdorndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976187, "uuid": "b7f50fde-3768-4e1a-a7d4-08c05b7aaa3f", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976187, "uuid": "6539acef-2f44-4fdd-82a4-6149b72a4bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976187, "uuid": "50f8bb7d-fc18-4ff9-a342-bb331367cf60", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4cc218-3eb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776907551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907551, "uuid": "d7f4eac7-1b29-4613-a54a-3157303fd35f", "comment": "Malware payload", "value": "fd598a723a8fb1c5ab7b1a58db5fbd74", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907551, "uuid": "0da177bc-b5f9-4e34-a194-fbd26f51ba77", "comment": "Malware payload", "value": "100f0ffd73a011ade58e81ed08f79c59a3ed986101be94ca2718f3a4e84556b0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907551, "uuid": "1cf18f60-2086-4ad7-a0c6-b7b04427a1b5", "comment": "Malware payload", "value": "cb8392a89735a7c70581f5f14302ce05016edc7b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907551, "uuid": "e7644380-9672-41ca-bd31-0a49727544a4", "comment": "Malware payload", "value": "42f829c3a97421269633dc4ac9c16508a5262d1f6c36191b98959c0fa5157851d8438d5f21479c04b1f1e81d0fd1d1d7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907551, "uuid": "e1425a83-da17-40ec-9624-4a595d0f3058", "value": "T179B26C2C09BDFA5D93D9E217EA95F3236D4A5CAFC2B975132AF34C6960024C045EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907551, "uuid": "ee08e218-602f-4883-94d3-175bf97aa463", "value": "384:oy2unDdtFVkGFk5CftjmFBs/RecofBp+I65IvLmO0AZJgTchh9firgZXX0GCfira:oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776907551, "uuid": "009898a1-f081-4914-83f6-ebbdc73ad872", "value": 25152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776907551, "uuid": "59b59b71-c4f8-486c-bafc-45bcf612fa25", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907551, "uuid": "0f74a990-752e-474b-b7e0-6d75b0464695", "value": "MG6UIMA6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628ee845-3f2d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776959958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959958, "uuid": "234cf6d0-c652-4009-aae7-f59e04aa785a", "comment": "Malware payload (ValleyRAT)", "value": "fd6c9697420a53eb56d2beab6d1766a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959958, "uuid": "50e061e0-bd6b-4012-b505-8ebfbbc455d0", "comment": "Malware payload (ValleyRAT)", "value": "1013bd0452176d2926946ab6aac15cd96887dc8402af7b88795b58c6e3c9ab1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959958, "uuid": "4185bfa3-30a7-40fd-ae78-eb62068ef69e", "comment": "Malware payload (ValleyRAT)", "value": "15e678a3d7766fff55df0c2e2aaff555ec8495ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959958, "uuid": "2ae436d2-1d49-4ddf-903e-a60fc1363f6b", "comment": "Malware payload (ValleyRAT)", "value": "8b512265f8add0fb0a59ccf1f125b6245594942019b61b18426923b860d92ded989331672461befe920131dbdccc5ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959958, "uuid": "3c8936c5-bdf2-45b3-8504-7eafd948582b", "value": "T110E5AE06A2CB9295FE98627544ABCBE1C2A3ECE47E3115DF9C0374299F331B0B715E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959958, "uuid": "7c4c4fcc-61dd-484b-8490-30444ca07dea", "value": "c373a3db94922ffd26e7ddf46174b49b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959958, "uuid": "3051e21f-99c9-49d6-9381-faea0751117d", "value": "24576:HZZjLlG47pl3I65ZQAtlJIGfia6oY3hJQDlpM8hhMPh2f3OaArFrtwgymIWr1UkC:XlG4/75JtlJIGfy/YlCoqg3OrTMmIQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776959958, "uuid": "9e005ca0-2bb4-4595-9763-d6882746407e", "value": 3096576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776959958, "uuid": "c0233d7c-758b-4495-a4b5-ac7b8eb6d010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959958, "uuid": "01309567-8120-4393-a263-621bc4696725", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u6c49\u5316zh-cn\u8bed\u8a00iR15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab829d3-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776931866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931866, "uuid": "75293159-400f-45bb-ad38-41db0877da62", "comment": "Malware payload (Formbook)", "value": "09b1a75b7011eea9d780b56178f8de6e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931866, "uuid": "abf28d2c-73bb-47d0-9f37-43d502bd316e", "comment": "Malware payload (Formbook)", "value": "1038df0ea12d61b15f6d65c03f2ac3df0cd0c31522fc4f2993cc6760ebdf2716", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931866, "uuid": "01542a64-49e9-47ed-80c5-a732839d408f", "comment": "Malware payload (Formbook)", "value": "c9c081cf6ffaa0e6ae1b0b200feff76fc6bd2a87", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931866, "uuid": "0f1781eb-d69c-4aa1-8563-0385202faf36", "comment": "Malware payload (Formbook)", "value": "c441d7720e134c1b6fa0cfd7f9909b1e2338d14daaed828d607a8f136e1581a31020462298ea8aa3d9a8899286cc995f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931866, "uuid": "11c75524-4d91-416b-a2af-a71b89d47ad6", "value": "T111147D1B32F0491CA4EF3B9099A91A9A2F377D343BB7704402A9235AC962D45DFB4377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931866, "uuid": "44ad5c1c-335e-443e-a789-074cd251e6ec", "value": "3072:uHH9Vt+2yqloj9IrhrWUGFrduwUjRRzjpBdkjliSgJRMt0Imze1MOxj:IVFyqlo2J+rcwUjRQjlGYttmzeDxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931866, "uuid": "9a94b41e-274a-446b-872d-8f666bc4d3c1", "value": 203806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931866, "uuid": "5e0f17d1-fbc4-450d-9039-2b699957f1f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931866, "uuid": "ee906164-1a22-4161-828a-10a9d6044df0", "value": "WhatsApp Image 2026-04-23 at 10.16.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df51093-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963440, "uuid": "7b2e3f89-8633-4937-a879-1bee64c338cc", "comment": "Malware payload (Mirai)", "value": "d31c3bb7ee0f0a7798da47bde1b6e555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963440, "uuid": "4470efe7-0aa2-401e-8a50-41335c6cddb5", "comment": "Malware payload (Mirai)", "value": "10c177d688ed4dc7492308f80e632be1de4a723b2352864c178c36320f4d6630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963440, "uuid": "a06d83cc-f84c-4fdc-8600-3f52523cab6c", "comment": "Malware payload (Mirai)", "value": "8247888734e6f1acc696f0bbc471797e3fd0b25e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963440, "uuid": "e48f678e-d5a4-457c-9aa8-64b27f88d655", "comment": "Malware payload (Mirai)", "value": "c74f92c60aeb3e3f2ea87ff2903d548040fc2107707b49e9352e500d02d29452548639b93f95d9ecc3abe58b107dfefb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963440, "uuid": "a1f03c20-facd-41ef-8ee1-b529db4470a4", "value": "T104532913B94180FDC59EC174172AA63BF673797D0235B3AE3798FB126D49E214E2E680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963440, "uuid": "a5c30159-507d-4fc0-9421-fe7c322b3be4", "value": "1536:CdRZSjx8V2X3+zJ1dBbL/6m2yMiQlSZstb+NBJspqlBzo:yRZS98VcuzJ1nbkyMiBqb+NdlBzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963440, "uuid": "6a72f875-77e0-4d40-ba26-a3227f253382", "value": 63264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963440, "uuid": "725006fb-9811-4ed5-b6eb-f4c32a0680b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963440, "uuid": "c112f176-7b3c-444a-933a-a13c9e38dbbf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0219ca-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982152, "uuid": "1bc7ad3d-3fa2-4362-9c7c-da06f33a1d0c", "comment": "Malware payload (Mirai)", "value": "1151008bf6424b6d7e6f3f49248ba237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982152, "uuid": "0ae3a839-079f-48f5-a3ef-a15f90ce6e09", "comment": "Malware payload (Mirai)", "value": "1114247017846263077a1bebeb5088dc6e520e312c6610b9a983dc723bd1e56b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982152, "uuid": "d93e4acf-5fdb-4e04-92e1-ad1245408b72", "comment": "Malware payload (Mirai)", "value": "d616f86f188cde21321682c00217681d2e35f751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982152, "uuid": "c093aed0-c718-499f-95b9-5560100af81b", "comment": "Malware payload (Mirai)", "value": "840b07ec4211883d030554e088e42777687030d872199a844f43a02f75576fe1eb97f26c28b767de65f058eb1aaf152c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982152, "uuid": "b3ef1c40-b022-46c8-a721-e71c4ddb0c95", "value": "T127C32A06B30C0947D2632EF03A3F6BD193EFDAC121E4F641256FAA8991B1E325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982152, "uuid": "ce2a1e2e-ce95-41bd-9ff6-e943f4cab394", "value": "1536:7fGNdxfWDO1zgwlaxpivT5Not6mGBgKnLM0xvALImeyynknqvjhkwALDYlH:7YJewlax875gUgWLM/LpwALDYlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982152, "uuid": "854602be-6aed-4b61-82e0-0e93f8c65810", "value": 129916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982152, "uuid": "44093cf1-fee2-4539-8aab-e072b323d18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982152, "uuid": "9bec49d0-a056-48cc-95e5-bb924f274399", "value": "concakhbtandhuy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1327bcd-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987578, "uuid": "3d9235c4-f4f3-4df8-97dd-39b5e181f3c7", "comment": "Malware payload", "value": "9ac7e2e68daa7419dbe8e7bd9b8c4399", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987578, "uuid": "ed3a627b-a853-4985-836c-d5d48fce45fc", "comment": "Malware payload", "value": "1156b3aa7556a4ed405c933453f6ccca91369b55a9847fdceace6d0ef1a38a71", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987578, "uuid": "566dad08-c6ca-4620-a0df-4bd3d904a80e", "comment": "Malware payload", "value": "385eaebe7e85f3f257d220586db93e6a5c19e3f7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987578, "uuid": "ea7b40cc-341a-4b60-9d8c-0a8a14a617f4", "comment": "Malware payload", "value": "46bdc7de920edec9233519c54c98238aba24081ee89e6b9bf4cf4ccf00ebab95c878971734261904c90a71bce1b5f2df", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987578, "uuid": "c054d712-1b9d-4b29-b10b-9e9ec7550bfd", "value": "T182A302025DBD18B5BF20E27730CDB36D95978690C90249E2B8D1EEA22C086D67F4D3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987578, "uuid": "80bb8896-b225-4e6b-b1c0-d7589e57f469", "value": "3072:GxxHk/2pFF42bp3Z5fa2jFIP5/0/4WArv1TvZLpyCifSdYwdXWErg:qK2pFF4yp5fBRIP10/41DZLM/SdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987578, "uuid": "372d72ec-b4f1-473b-afd5-7ad59a64fbd1", "value": 102032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987578, "uuid": "5893c974-ad27-46e5-a921-20113dfc6e55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987578, "uuid": "930b1b18-be07-4b60-9105-1491df8f2554", "value": "SERIOUSLY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60021e90-3f43-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1776969403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969403, "uuid": "780869c8-b257-45ad-a0a9-9aab2db1a97c", "comment": "Malware payload (Fuery)", "value": "a9e02cd314b1d0db6eb481f52ff0ab36", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969403, "uuid": "dabfdd1f-d0d9-4752-80e4-27ac7ac12306", "comment": "Malware payload (Fuery)", "value": "12991ee152aeccaadf10634e11017eab2ecf13b3853272a46a7f7e8c5dec2507", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969403, "uuid": "59d23408-5364-4ebd-895e-60fd22a35997", "comment": "Malware payload (Fuery)", "value": "848a73c622664b8eb1572a01d0acb5330317eaa8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969403, "uuid": "33007ae3-3adc-40f9-8e6d-3e0ff2bc1023", "comment": "Malware payload (Fuery)", "value": "9f47e80548a73e726257961329213159d523c414134cbf04dad8efb0557927406823af42305b98d35089543ffac31967", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969403, "uuid": "926234cd-9efc-4040-a82b-00d45f33ebb1", "value": "T1242523316A06D892D4C107B61EB1E3B116F24F4EE943C299D6EEFDF7F4153A2B4A8160", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969403, "uuid": "d3144734-8bda-46e8-aea5-e593186b2f4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969403, "uuid": "1a053e82-e299-4379-93e6-9e71b9153865", "value": "24576:BKCJEdFi7Td4I4oaghuaYskQ+aqXkGnQZ:wCiU7TOoagDYskQEXkGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776969403, "uuid": "94d2430a-7b67-4e78-bdd0-31b1687e3a40", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776969403, "uuid": "a712d576-1e1c-47a6-8f6d-19f06b1a0643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969403, "uuid": "06c8aa78-56bd-413a-a092-495a6ab72fa4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d087b1b0-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954130, "uuid": "0eddeec0-2cae-458d-a08e-4360aa62585b", "comment": "Malware payload", "value": "475de08f82f7bcee57b82b4e32a19393", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954130, "uuid": "adfbe4ff-52b0-48c8-941b-68e997a2ffd0", "comment": "Malware payload", "value": "12ce05998af6d64419888e9568f7bb4fd50545e412c4cdf50a8018dc73cfe74d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954130, "uuid": "6e309e82-23a7-489c-881e-86d834ae45ea", "comment": "Malware payload", "value": "2b144b1db5c7cc41be1b364bc6f68fd8b587ea54", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954130, "uuid": "121b45f7-083d-4999-8ae8-4f4620c0662f", "comment": "Malware payload", "value": "5732a024d036d3c72462628c9bf56b3834bc65b91fb50504e923df8faa48599bb54b802d312d669291264c4ed3490ba5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954130, "uuid": "f1624912-51f1-474a-b3f8-933ab1ff3cc4", "value": "T14831874FABC9F27118F3E19759597D4CFFA00B1F5054D0D8B89898223349B399E941D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954130, "uuid": "dc28e1b6-5399-494d-b06a-f54d3ef7349f", "value": "48:IjJNQPFtiym6gB7TAHSRvPYQV0/AzARt2:kCuT4i6/AzCt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954130, "uuid": "73e6fd3c-3528-420c-aafd-eeca99493692", "value": 1791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954130, "uuid": "b7e8bd55-a033-463c-8816-4000574732b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954130, "uuid": "881d6604-f76b-4c41-8706-3e00e291778d", "value": "paperaccess.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c533212-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928111, "uuid": "a78f50a6-1889-494c-8ecf-02006e0393e3", "comment": "Malware payload", "value": "3847a188e23cb8392474431bf19b34b1", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928111, "uuid": "521b4cf4-9067-47c5-a88c-dd17556b4ec5", "comment": "Malware payload", "value": "13986e97e4d0496d9085106f554f23bff930b13c6576d2419a9858ea4002d33f", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928111, "uuid": "4a031c16-9ce0-4f62-8565-2c6e649edf27", "comment": "Malware payload", "value": "7446d5e26e0c9b854e75d3f3a7482b36eb5b9766", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928111, "uuid": "a34c5da0-ba50-49ef-afd3-3072e7b2958d", "comment": "Malware payload", "value": "032ffeb7be7e9fa220c00bdc8269d1bf9d3310bcaceb2bd851eb65ddad39cccf50e5038132672bdb5177c2e6cbe43f39", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928111, "uuid": "056a3b24-2652-446c-b932-67a466975f5e", "value": "T1D52723245E3C5DCF437AC93D542E218A11430F180078EAFE8FB6B96A4ACAF1D6A53D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928111, "uuid": "e09ca1e2-db90-4e7b-b8c7-e8374a0fc8e2", "value": "49152:QJdaJdmJdIJdiJdnJdhJdnJdfJd6JddJdVJd9w3JdwJdSJdPJdEJdGwKJd6JdxJK:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928111, "uuid": "60ca20c7-7777-4177-ad89-c4f5a5de5a17", "value": 22091523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928111, "uuid": "a7eccedc-e151-417b-8bdc-d2b87e600643", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928111, "uuid": "5ec82df2-c112-4b76-9e75-28342447c2da", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c6604a-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968292, "uuid": "1dd3b344-5321-4d79-a71e-3b4a3568201c", "comment": "Malware payload", "value": "55fdec09770cc16517ef37585b43c2f1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968292, "uuid": "52491040-7637-4d05-829f-bb97a338bdb6", "comment": "Malware payload", "value": "13d67a630b8536f27c95a0df268741a27fb08ff0ccd27bb5424a5eeeb0741f52", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968292, "uuid": "f89d615e-2619-404d-9758-d9b8e6cabbfb", "comment": "Malware payload", "value": "fea4108fc632893cb4135db06ff65d851057a292", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968292, "uuid": "0954b40c-df6e-4a31-ab0c-982f5050ae3e", "comment": "Malware payload", "value": "233677adc0b7777876831bbdd68d561d25ddd3eede2e775c65cfb19a115763d22889e950b9f5ab8d90b66615d5086354", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968292, "uuid": "0297dc56-8d97-480d-b610-dd43d818c11c", "value": "T11006F186FF19952FC87700724FAA877532569D138E839B47A858332C6877ADC0F49BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968292, "uuid": "1145cc25-10c6-40ca-9da0-7974b557a7b6", "value": "98304:rHw/Qq0FkfoH9BWFUL9zvcsR+T+fPMjh8JWL9TJ3+MEW:bGQDkggmffUfHEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968292, "uuid": "1bd82913-9899-4498-b04e-ed8027596be5", "value": 3948292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968292, "uuid": "0a2478cf-96df-4444-bd38-3f9f7faee3f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968292, "uuid": "5b292a88-5c82-4c78-ab58-f7f08982c220", "value": "13d67a630b8536f27c95a0df268741a27fb08ff0ccd27bb5424a5eeeb0741f52.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f253976f-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934429, "uuid": "d47a9572-9805-46d9-8175-bddbc96b87e8", "comment": "Malware payload", "value": "62fa052965c99b079843676878960f13", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934429, "uuid": "20a99d6a-20ae-496e-ab88-65eb65f34bc5", "comment": "Malware payload", "value": "1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934429, "uuid": "568f57bd-c20c-4d27-bac9-13515a1b389c", "comment": "Malware payload", "value": "bc199ad0581cd90e8b532385996fe58af94d1439", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934429, "uuid": "15e4a090-2169-408b-8540-eb99279cdd60", "comment": "Malware payload", "value": "6b673a7beb0e2b89ba4e74f9e773427c4ebaa13d826abb98a0b7ecc1b830925df0ddf23171fed261f0ad8a5a9311aaac", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934429, "uuid": "71d5c5bd-1042-4c86-999a-bd0b74142d30", "value": "T1F31219207E002EFF67B078C108C4900CAA78B674D7682ED568EE4CAA255D3764976DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934429, "uuid": "4914aba8-0248-4d70-81d8-4774bf9d7818", "value": "192:qxvI/U/9hzKDrM7uiNFQpQfu/It01dc8NfEeDs/BMEdgAAFuYK:qxAgzsULtz8NfEeDsJMEd/B5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934429, "uuid": "65601441-66f9-41df-bb3c-fee8b558ccdc", "value": 9359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934429, "uuid": "a9d576c6-790c-4af7-8773-5775e1a083a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934429, "uuid": "40de23c5-b265-4a68-80e6-f0da961338a8", "value": "1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c608853c-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924477, "uuid": "f8779c13-99c0-4cc5-8b82-02b5ef9b33d8", "comment": "Malware payload", "value": "f56d2f7735f1b78e609418520e9ff38d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924477, "uuid": "bae9625c-86d3-48a8-848e-f3dd88abc85b", "comment": "Malware payload", "value": "14af37d9144376e64ca3e13da72a066c9490c299104bd418a4a40fd8f3fa6bfd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924477, "uuid": "c2def890-0184-4836-add5-85cc56403f7c", "comment": "Malware payload", "value": "368fb04970aec2abd0f79da4f08f43f7b2eff8b0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924477, "uuid": "20fd4c14-8821-433b-b62d-5977e672b481", "comment": "Malware payload", "value": "50712e98e9bcd0083a1faf542a352b1ac8fa66e1b540d40245cbdd0a2a22d3a5aa8cbad626bcde954d8491e54db87213", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924477, "uuid": "00ff8094-52f4-43f5-ab70-24c659530897", "value": "T1C9E086CA365520939A2CBF08F03AD3AC6481B3C070B04A50B02AA664D4A46403851B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924477, "uuid": "16335c7e-19e3-4251-835e-fea5cd00912a", "value": "6:hoMY5y3dJS6BQdma0LKi6BQakICBQVRBW0XBUR:rY56dIqQdma0LKjQECQVpUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924477, "uuid": "20627b6a-42fb-44c5-a8d3-d5b79d9e6dca", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924477, "uuid": "a03cde7e-5feb-43a2-91da-ca53d5996f2f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924477, "uuid": "c9a37948-9e41-4bd6-8de7-d03a7e80a0dc", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78263655-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928211, "uuid": "53bd0435-b56d-412b-9200-e3e8daece34e", "comment": "Malware payload", "value": "5295c5cb5bde41249a4f71d3dd395ef6", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928211, "uuid": "70e61fbd-46c1-4146-b920-a27b1dac520d", "comment": "Malware payload", "value": "14c23b45254e39037f9b44b4b960b3c6f5daeac62cbc09212fdbee1d9b7e5f20", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928211, "uuid": "73afe1d7-664c-4576-9a6c-1768a57a55e3", "comment": "Malware payload", "value": "a994b3a91d21bf070397dc759a8dd2ce5097e2bc", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928211, "uuid": "81688719-34c5-4a45-816c-97e297493d73", "comment": "Malware payload", "value": "d0bee621a8a96a19237e84572214a5c72bad10c114c423b50519ebbad4f9c41e87ce7e694846ed723dfdb73fb175d8d8", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928211, "uuid": "13feb991-1cb6-434f-8e53-7baa19ba96cd", "value": "T10127232B0CADCAFD5214564C00EE496DB8ED8B0ED4325F78F25978D1C7AC65B322B762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928211, "uuid": "cb9580f1-bc76-4054-bdfa-7efefeb85bf9", "value": "49152:4Ud0VQUd0VvUd0VKUd0VeUd0VlUd0V3Ud0VvUd0ViUd0VgUd0VxUd0VwUd0VjPW1:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928211, "uuid": "13630fb1-8c11-4e34-b9ab-451aacb1e017", "value": 22091535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928211, "uuid": "ff274e54-a1f7-4d1a-b25f-9364491de651", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928211, "uuid": "ce3602e4-b8db-48cd-a9af-3a3125a9db28", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec71987-3ef5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776935846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935846, "uuid": "ce65db8a-c29d-446f-bfed-f3c5ceba6a57", "comment": "Malware payload (ValleyRAT)", "value": "c200f409b940ec23ca8ab34853d3b92b", "object_relation": "md5", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935846, "uuid": "d52e3666-106a-465c-a038-eac8f19a8bdb", "comment": "Malware payload (ValleyRAT)", "value": "1542290c51175ac36d4a0bbd8b2a8d3d870707f29d640e41a5648496772b39bf", "object_relation": "sha256", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935846, "uuid": "38bb1c54-d041-4cd0-98d8-e98464bff457", "comment": "Malware payload (ValleyRAT)", "value": "3d549a016c592343458bd867938f7eef1cc7cb93", "object_relation": "sha1", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935846, "uuid": "def5c116-d787-4cfe-a717-5504c49da3a3", "comment": "Malware payload (ValleyRAT)", "value": "58f1c35a3caf08fa5a56a2fb792c9c535c7cc7b82952cfcc729f35018157cf6a32e8169947858c3d0c5b2a4b652aaa66", "object_relation": "sha3-384", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935846, "uuid": "6d19df7d-9d3b-4a89-8993-f44ee3ce5419", "value": "T1D4245B217780C17AC19B153199BB9F721ABD7932076981CFB3949E790FB03D2BA7470A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935846, "uuid": "f5334a0b-ceec-48db-94a8-c166f05a324a", "value": "ee113de6a7e41d580c082b16b3603fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935846, "uuid": "dce68ddf-c1b3-41ed-9ed4-1a4e684f1ae1", "value": "6144:YMBBwDbYhqu/pxHyYubw4gRaGQ9u0Qr8f6p:PDwDbY8iKbw4gRaGQU0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935846, "uuid": "3785c2ea-4319-4f4a-8ba1-374fe6209887", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935846, "uuid": "6969d997-4b62-467b-994b-54be42885bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935846, "uuid": "9f65df66-6c80-4685-bdd9-680e1ee22b8b", "value": "1542290c51175ac36d4a0bbd8b2a8d3d870707f29d640e41a5648496772b39bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58840c20-3f57-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776977980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977980, "uuid": "b2f7307a-cad9-404a-a9d0-f6bd9242c01f", "comment": "Malware payload (Smoke Loader)", "value": "d85c7722f6cd3858da7d85537e298d61", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977980, "uuid": "c1526f12-7af8-474a-ada7-fd2c50fc0eb3", "comment": "Malware payload (Smoke Loader)", "value": "154e3276f14bf8136526e320c6062f76feeb17a3988803a30aaa077a7ffa6b22", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977980, "uuid": "90285033-febb-4388-883c-0c70ce7b9860", "comment": "Malware payload (Smoke Loader)", "value": "89b16d0a54d90e6a2a1979ee1c6dc484cba06bbb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977980, "uuid": "966fdf55-b6fe-4c76-8c5d-d7b09baaa13a", "comment": "Malware payload (Smoke Loader)", "value": "5c1c9a99c12c0d18dc93b9474f8b8d1f6c852164084b28a3903f78880d8bdc3d649fa5a9a9cc26e5bdeb912d3dd48d81", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977980, "uuid": "0b841541-316f-45ba-89be-2344fd67cec7", "value": "T15341B25067E91204F6F37B557E7E94690A3B3D35E931CB4C42A1184E06F2E20C966F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977980, "uuid": "89c539cd-a2cb-42a8-a8f0-e56b59716d1d", "value": "48:lZD1sAkD10qR9VxVumyncyVxkEwIXrAC5aU8Dra37vOPmfjHX4AfMHnu:z5sZ508fxAtthwIXrAC598DrarGPm7H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776977980, "uuid": "e16bd0f0-e911-4ab6-b0ee-127ca9532a41", "value": 2338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776977980, "uuid": "f3a31866-5f90-4f13-a9e0-8f845f716260", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977980, "uuid": "60abb438-75a4-4ac0-ae73-d2198de45e99", "value": "tmp7120.tmp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead45b04-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927974, "uuid": "796e2af0-0a47-4ca7-9d2f-916c589d7048", "comment": "Malware payload", "value": "6631b47ded4033f322cafa12991f8bbe", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927974, "uuid": "971f5cda-454e-459c-a8dd-27dc75ccc1e4", "comment": "Malware payload", "value": "155ba32a511af047b678283388d099ce9aa38d04cbd0d346504e65183f6d3092", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927974, "uuid": "4c4ff5c2-3dda-41b2-8801-164fc36b5119", "comment": "Malware payload", "value": "4443424b393069fff5053d20127d0e94470afe72", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927974, "uuid": "ec59f673-bea3-4bee-9b25-f8d309eb73a7", "comment": "Malware payload", "value": "5c528efc714025a3be6aba20aa8dfdd2244adbc3c9063690ccb1b17099ccf46a689fdb1191cdb1b5f9d7ef0929a9deff", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927974, "uuid": "4c45b4b8-15eb-42bb-b8c9-7377e558ec0a", "value": "T126272216972A86E2ABB53328483C0CDD759C9D0882B6D5F7D9E10D8FF01A7B3246FD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927974, "uuid": "86fa7e78-cc2c-4811-b176-d12b929a364f", "value": "49152:W777G7Z797s7m7x757L777v7nV7L777m7f75u7f7M7F7M7l7m76747f777J7L747:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927974, "uuid": "d9d28ff7-a9d0-41bf-9432-0717fec6eee1", "value": 21611525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927974, "uuid": "2ccdc0a9-609f-4abc-8efa-d71d24ca92d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927974, "uuid": "28421b00-2212-4ded-9daf-1028f9423e32", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b36a29-3f54-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776976850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976850, "uuid": "6fdb6d6c-a1f8-4307-a5db-96d2ff292900", "comment": "Malware payload (Gafgyt)", "value": "b281d6f4cf23f7ae7fd031b29a5809e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976850, "uuid": "8de39e2f-9e3c-49dc-82b4-de5a6c7d2e4a", "comment": "Malware payload (Gafgyt)", "value": "15cbd2d8067d46320cf95af436b6fa3f3cd296286d9337e8c277989eb27fce8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976850, "uuid": "6aeb8fae-a262-45de-b127-a1f67818fded", "comment": "Malware payload (Gafgyt)", "value": "685bb765911f20c8740e586b3afc20707f0e4385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976850, "uuid": "a3ecf6d0-ce99-46a4-8876-392d8f3b0545", "comment": "Malware payload (Gafgyt)", "value": "0bedd00d132301385a2842c65535d117a161118df7ac1b1fe1d35da92a0eeae8ee590bf780c95d01d069b71c70d406b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976850, "uuid": "26d27578-1959-4234-8760-0b5c318ae620", "value": "T1E7630942BB42DE77D00320F212E79B660931FD7E1826DA4AE3647DB5EA351C0D616B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976850, "uuid": "df7470c6-2f3e-4805-ad7b-8680dbc7e88f", "value": "1536:j45PKEB5NIjZxwTkKOdNK3+BvzyIKIkoo25oC7mR7S4v1Q/wxg:j45PKiIPB+OBvzyKoCmRnre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976850, "uuid": "f9b8dfe3-a969-42e2-a2d4-80a85ed560e2", "value": 71388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976850, "uuid": "695b8b63-e493-4fbf-939e-6a2f3067ed70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976850, "uuid": "008e1abd-d3a4-45e3-a8de-838361c462bd", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd17d3e-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776954068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954068, "uuid": "dfa250d8-1251-4b9f-9614-de25ca432e27", "comment": "Malware payload (AsyncRAT)", "value": "b050961d4557b7d2d9af557e5fdad5ab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954068, "uuid": "a6b70b87-2e64-461c-852d-6096ffe1db19", "comment": "Malware payload (AsyncRAT)", "value": "16007fd9454eecba4a5ae3e696e3a51ab8760323efa0eb57433ce2d5eeabc6ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954068, "uuid": "e39262be-5cbf-4c95-94fe-62e89aec5273", "comment": "Malware payload (AsyncRAT)", "value": "411ccfd4d7faa5c312b422f93e8ac42c23f38146", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954068, "uuid": "8a6141bf-1722-493a-9d9f-578743e86e55", "comment": "Malware payload (AsyncRAT)", "value": "94f7b05a302c5d3f2ee179e990bbffb04ae4b84edcee77536ecddb43bc9dc367491ef25af5388b0cd100e380355d0759", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954068, "uuid": "4788fdec-a426-4e25-9e2a-58a89f29067b", "value": "T19E75E17DFB343191F91C9EB0BB009A9413EEEEDA86DCCF4466813E158CF96605689C36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954068, "uuid": "5058cede-43f0-4de8-a001-56ba75ceab89", "value": "24576:y/dbW6yxOxV9ThT5fbYr63oQyZHdQZf+DyEbps8T1q1jCGtzlE:EW6yxORZ5IYLyZHCd+3pbT1qtli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954068, "uuid": "ecf3e525-04bb-45d9-8ab3-45370d167ef2", "value": 1570694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954068, "uuid": "fccbdd1d-9cf8-4a2e-9a99-f158c8d6db4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954068, "uuid": "654bd922-bb7e-48e1-a1a6-16fbf96beca8", "value": "Tax-Number56563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80f2e4-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955601, "uuid": "4fae2969-d524-4e0e-b515-1595f016fd7c", "comment": "Malware payload", "value": "5cd6a243247bc7d924edb66926bf6017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Gopacket", "colour": "#B867D4", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955601, "uuid": "24add7f2-2782-4c65-9c05-a3c90210d2bb", "comment": "Malware payload", "value": "170ef61d8089a3c57ed1a078f81af7e4a433321c6a96b2a96e35a950dc0834e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Gopacket", "colour": "#B867D4", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955601, "uuid": "ee9ecc38-98aa-4186-8cdc-78c8d162c906", "comment": "Malware payload", "value": "0ff9aeb4af8676086144c33748c948393d7cd442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Gopacket", "colour": "#B867D4", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955601, "uuid": "49b9616f-2e7f-4d57-95fe-deaeca06cb32", "comment": "Malware payload", "value": "dacc54cc432413e39afd5cea415a87405a9069b782fb4c4b3fa66e410bff620a91687ef3719204d1bbdf4ca502ac287e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Gopacket", "colour": "#B867D4", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955601, "uuid": "08d43c2b-b2a1-46a8-93f7-b69d042635b9", "value": "T1A7969D03EC9615E5C1DA9130CA7692627B71BC496B3223D73F60B7786F72BC06AB9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955601, "uuid": "baca6e32-0b0a-43ab-94d3-e7f2e9c592d9", "value": "98304:1ZBnXXMTin4uyJLm7fE6U/m/ESAAldPpfW2fV5SJoft1:VZn4ub78J/m/PAKReU6a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955601, "uuid": "769bee74-f40f-42fb-a382-62ba434bdc88", "value": 9098456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955601, "uuid": "d08c1fb0-c8c8-4a93-a4b0-ba50cfecc782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955601, "uuid": "07f3e3db-0e4c-4f51-af0c-02c644ee478d", "value": "170ef61d8089a3c57ed1a078f81af7e4a433321c6a96b2a96e35a950dc0834e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff286551-3f52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976112, "uuid": "96f17685-be5b-4063-9f0a-7d126d9aa0e4", "comment": "Malware payload (Mirai)", "value": "9aab551b8611c8df33910a35b7c25333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976112, "uuid": "0eb1fa6a-96d5-44cd-ade5-a5191c7e9205", "comment": "Malware payload (Mirai)", "value": "17a28810eec77ac74692fdcbd263689e0c21e36a88b64614e5322af0f636ae9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976112, "uuid": "72316204-ae54-499b-aa4e-a3326308795e", "comment": "Malware payload (Mirai)", "value": "7943c3df9712788eb4b9f6358d513c1fbc47c8c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976112, "uuid": "0dc43184-2a94-4f85-8bf8-455cb7932512", "comment": "Malware payload (Mirai)", "value": "1aebf0fba8583bb3dc3528ea6efa5d75c6126302c8f2f5212edc36fb41c301429b49a4f3a9efbb8a469470b16784e726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976112, "uuid": "b65d067b-5368-4cd8-99fc-fbc26302e970", "value": "T186041A46EA414F13C0D627B9FADF42453323AB9493EB73069528ABB43F8779E4F12506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976112, "uuid": "15e644f4-3c96-4101-bf72-3deed42e0660", "value": "3072:qs+G9rXs9crw6HiTiS+PaO1bVnTr69OaXSXdPdP6owM/Rby2+aOL:q4s9d6H5XPaO1bVnTuXSNPxbwM/RO2+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976112, "uuid": "e4a0cfbf-217a-4b29-8be6-fc6ec663ce91", "value": 188821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976112, "uuid": "2f522887-7586-45b6-99a6-72195ad87c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976112, "uuid": "ea9ce3c3-beda-46b6-b272-6e11d82bc50e", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae51422-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776931223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931223, "uuid": "ea9ab2bd-0256-4886-a7d9-acc16fa7a52d", "comment": "Malware payload (PhantomStealer)", "value": "68609ae500ca4504ca3fae245aaeea3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931223, "uuid": "0de1e3e6-eccb-49dc-8989-e1b7d19d2473", "comment": "Malware payload (PhantomStealer)", "value": "197c9b2fe8116d8e9329c5ab49f7fa2a900d27704bb8d36da9d1bc77f2239b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931223, "uuid": "60d8d9c5-b541-4a91-9083-6aaf9304d3c1", "comment": "Malware payload (PhantomStealer)", "value": "02e3c05f091fe819d2cdbb6fdcb5ec1063000b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931223, "uuid": "38c8938b-1d52-44e6-be7a-9bb9a0540772", "comment": "Malware payload (PhantomStealer)", "value": "fcdcd7984c4e4ef1f8478c2ca7c6cf484759e5d10cb18be9a71a5732aa169150282e85cdeff118e9223480052c282e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931223, "uuid": "170b8b74-83b1-4989-9f09-4d9ae262f7a6", "value": "T1576523D60BA5E847D05107B10AB1F3B2A6950D8DA500D326EDFFDCFF7428B69A81C6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931223, "uuid": "ef554a3a-c64a-4c40-8b10-44bfa33a2b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931223, "uuid": "af3f5f4d-5c82-4393-af3d-942da6a32e64", "value": "24576:LiQCmMMHyq9mNYCTyjbowoiqvhuBSdUKONgdmJ4hfPgSoDf:LymMqVM1T5RjuSHmJ4hfPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931223, "uuid": "6a3c220a-75a6-42fb-a1a3-b52006335d0f", "value": 1464832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931223, "uuid": "30bd08ad-8472-419a-a026-4768ccc9fecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931223, "uuid": "233ada72-947a-4569-b36a-0b64c442c6eb", "value": "rITM36783-36799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f329c4d-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972354, "uuid": "b0d91a0f-5100-4fe5-a36e-f78096f31f1a", "comment": "Malware payload (Mirai)", "value": "40d6ab92d64b7f2222a2b55bfd75350c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972354, "uuid": "31a22210-e89c-4a5a-8e8c-c1841045fcdf", "comment": "Malware payload (Mirai)", "value": "1985615b3a7fbf558ae268523725783d1661a821d4724a500087a3047a33b4c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972354, "uuid": "a7839b44-f6f4-4bec-9cb9-a9897f7f1adc", "comment": "Malware payload (Mirai)", "value": "f61a5a7c655832d8285ca22cba01543eb30ab20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972354, "uuid": "d5f9b860-9379-4831-a4d6-ecc2989a157b", "comment": "Malware payload (Mirai)", "value": "e8cf6a51b9053ef226b953a58316ea16e4a5144a03de99a840b3eabce0c4fb60c32d3d635351f20fefc8f71871995ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972354, "uuid": "09e1e987-04d8-4586-ba72-3359ac7f08be", "value": "T1D8C32A46A9C29F11C4D621BEFAAF815D33136BB8D3EA7102D8325F6433865AB0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972354, "uuid": "92bfc90c-45ea-4fb5-a437-2d775bb07d88", "value": "3072:JpMzsP01VriViaaPVoQmlCpnDgJ72n2kQh3a:HMzsWlQiaaPVoQmlCNDE22kQh3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972354, "uuid": "2ff63765-2a88-4973-bc03-9dda31362746", "value": 119092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972354, "uuid": "77a5cb46-b500-49a7-bbf9-b05d2539945c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972354, "uuid": "cbc35027-a317-44af-a062-91318e2b62c2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac800b9-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776976293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976293, "uuid": "824d7f5f-83b4-4094-aabe-f1d7fa68508a", "comment": "Malware payload", "value": "d59f50d98994a452d90f7bcbe0ff4ad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976293, "uuid": "0d3c82ff-16fd-43ae-bdfb-45e04a2838f4", "comment": "Malware payload", "value": "1aba4cbc9df35fac320f09c7507671648808d4ba632e6026f2f04a6384687dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976293, "uuid": "0d132fd0-8064-49b3-ae1d-b85a591c5710", "comment": "Malware payload", "value": "062fdad991a1c776eb27e8792936081a4c9efe95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976293, "uuid": "0c552967-92a3-49af-b374-dc35b8c4da22", "comment": "Malware payload", "value": "aa14edc4e90139ac0d4a21035bdce12039d621ee213b9c3682e6cf419c7d9005a29ffcf2c73a053a6471e4cd2bb67136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976293, "uuid": "5f2ef64a-62a3-4d2e-84fe-7c962e35743b", "value": "T18447DF77814238E9E5B98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976293, "uuid": "d2ece07a-bea8-464c-a182-e4c78255b26d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976293, "uuid": "fdba3015-c662-4050-919b-cd35bd4df1c1", "value": 25886720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976293, "uuid": "b168892c-fc25-4aeb-8f3a-a478470f24c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976293, "uuid": "bc550a08-aea8-4bd7-a21b-8b2f05701cf0", "value": "1aba4cbc9df35fac320f09c7507671648808d4ba632e6026f2f04a6384687dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35963d8-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985541, "uuid": "ac2e60ab-fbc0-4204-b3bd-4f8e7f7dd676", "comment": "Malware payload", "value": "416407eae7cc46b7ed1272fd0e0cb36a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985541, "uuid": "ddd24a12-10e1-4943-8a3f-b57e005dc398", "comment": "Malware payload", "value": "1ad9505e9f5c1cebb35567c387f740abe8c87fd3dba830d5235d84c7fe083be4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985541, "uuid": "e06932f3-d5b5-46e9-91bd-4d758114b128", "comment": "Malware payload", "value": "60b53fa2c4fcf0f3939806ed61bd958073118927", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985541, "uuid": "9305c003-16aa-4585-8a63-1504b81929a6", "comment": "Malware payload", "value": "b2540942ed9900396f760eeb81a82f3eade3c6ed90b565152947101a93ab631e1db42e41145e6363abf65df90b0d1dcb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985541, "uuid": "da4e76f9-c353-4971-9d93-48ef9b3fe6fd", "value": "T1D731133C3643DA9C13C71C6D04FD9555AA1C4901D2055ED8F7EEDA48436C3E196FF1A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985541, "uuid": "b7e7fef7-df96-44be-a1a6-77aaa4c0b470", "value": "48:k24RN8RcOYRx6mKB3rEqjB36F0qFXJ811Bd++rm2/1f2/62bOj:kvMax76TBb5jBZH+wmeff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985541, "uuid": "0b96b8ee-adfe-4bf9-ae4b-0add728765f9", "value": 1571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985541, "uuid": "d3071ce9-6623-4849-924a-c4263f676ea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985541, "uuid": "8345c908-9d0e-4c00-8dc0-7bb82384b959", "value": "10663-OWO-22427.ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847b59b2-3ef6-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776936393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936393, "uuid": "debe7d38-42d4-4514-b601-125d44e5b9b0", "comment": "Malware payload (XWorm)", "value": "56e0fc256889d11f64bd1dde0a690c66", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936393, "uuid": "76c3eced-f148-4188-859e-bd428b9d6a44", "comment": "Malware payload (XWorm)", "value": "1aefae3768c71d0c1b78d5f6a27e2124b34f07bb09d202950657557040a2ef97", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936393, "uuid": "e3a004db-dadd-4a68-8840-708a3c8c712d", "comment": "Malware payload (XWorm)", "value": "e76781f3ed114bf063c0064fd57d53c8f00712f1", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936393, "uuid": "8480fe25-2766-46a7-ab77-1912a0658a18", "comment": "Malware payload (XWorm)", "value": "82b73da1d5e2ff065778999a602636c1e7c6b0add1451dee613d5f3559898358a76158adfb23ee0a20d8165684439e3c", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936393, "uuid": "b8f58a8d-d938-41f8-b52e-0d59668578d9", "value": "T14641024612602027DBF0D64A436D2B006A0A559334055AAF326D53FB5D9C8F7CAEE6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936393, "uuid": "15e3e9be-6c30-4148-8a4a-5b7333c4db58", "value": "24:L3LD4eA5WT53ibnv14Yw5wY8Ysiiw57YDYsO+scRgP7/uVMWuVMSDXruVMiuVMUc:/D4IEujGeu1RmuruvDXru1unuJju/+Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936393, "uuid": "67bdfdcb-0708-4d06-ad02-2b10a9f06da1", "value": 2004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936393, "uuid": "ce3fe8a5-52a5-4ecd-9045-d9ada8b37e78", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936393, "uuid": "2c9943e2-eae2-4208-9f77-b96fcd72eff2", "value": "dat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4994f7de-3ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776919543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919543, "uuid": "876af678-8f7e-4ca2-8fad-2d78ee18ebe1", "comment": "Malware payload (Amadey)", "value": "1cd78549ff4bfbc19670921e44ec29f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919543, "uuid": "c7eeade5-4d55-47b1-b624-ca0fc9d9eb50", "comment": "Malware payload (Amadey)", "value": "1bb7b314205b20d1dd7f616ab7d688a88901d055d85232ba12c475b41ef04efd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919543, "uuid": "b682e996-97fe-4a8a-93b9-a416cd4a2d98", "comment": "Malware payload (Amadey)", "value": "467b1a1c76993f2897a1dae918c0de2770c3926c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919543, "uuid": "f4bf6663-bb14-4ec8-a4ae-111f522b9fb2", "comment": "Malware payload (Amadey)", "value": "54d004fdda965a393006200eb03d6a883fd0a99ee0b7b28c737d15468abd40c6f7d1ffccff7200d418cf5d11612ed50e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919543, "uuid": "685d45bd-8e9c-4cf4-adc5-6b17f459a97f", "value": "T1F4C080A53477BF0C029017D554029DD0F2250AE0767F5FD4C7C14BAF45C5566B03D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919543, "uuid": "ee99d7e0-1b3c-45a8-8049-da13c008f6f6", "value": "3:BP+wKBM2S4HE6RmKLTyRsrKF2xKt2y+zBJYgRJBRVBpddr5o2Mv4s26JqWRRmwtm:ZhKBM34HRpTCsu2xKt5gvBzBzdrK4VNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776919543, "uuid": "fbc390fb-0b44-41e3-ac11-93a615f72d47", "value": 174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776919543, "uuid": "ad7073dd-d051-45a4-9335-5d90c1fdc46a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919543, "uuid": "e5b6defa-189e-44fa-b8bc-b5fe7fe0a788", "value": "test.ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34b6e0e-3f38-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776964845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964845, "uuid": "569bb587-62e6-422b-8913-545d4888f0e8", "comment": "Malware payload (Socks5Systemz)", "value": "6afa2f0b21e121f1f9ea3e7b13e6bba8", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964845, "uuid": "a5d1903b-2ae4-44d6-98a5-d27ca8740692", "comment": "Malware payload (Socks5Systemz)", "value": "1bd2e5a6eb8505057ce70796891e6a15cdf1220034de1d7a27d36cececa92a56", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964845, "uuid": "74adc178-e2af-438e-a9e6-4aca804b00e1", "comment": "Malware payload (Socks5Systemz)", "value": "63310247ba959b8dfff7d82b53d281a42ceb4a80", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964845, "uuid": "570a2ebb-0051-453c-9aa2-ea6a88f56a58", "comment": "Malware payload (Socks5Systemz)", "value": "2c32ee9ac7315876bfa3326b08d8176e0ec8cb3b73bdffc330be967b75c25ed8c96287104cf6669d4bcc080cee58ef89", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964845, "uuid": "e002d63f-fb32-4970-bfd3-44da66b8984f", "value": "T16DF5330499012176E4D14D7015D2B095CFB93C243836A940AA7C7FBFAB3FA95CC7AB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964845, "uuid": "e976d0b1-f5ff-427c-b09d-2d4ebfe11ab5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964845, "uuid": "d18b18dc-adf5-463d-8969-a3ef7afff0da", "value": "98304:N5zXFIn3/M2zuMlb+FH6urx0jeqUTRToFsS1PnJtq90+:7O3/McuMleHlFWeqUTRcFsS1PnJtqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964845, "uuid": "9cd47860-39ff-45b3-96eb-93ff727a4a1e", "value": 3558847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964845, "uuid": "63e6127f-b1d4-4b34-ae0f-40635d3a8451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964845, "uuid": "fe364ab5-edb7-43e5-bd13-9f99596867c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33de41ca-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928097, "uuid": "3f3f8271-57bf-437d-8c74-f39482ebce01", "comment": "Malware payload", "value": "1cda828e8023c06eeffd5e807a075e30", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928097, "uuid": "7d660623-7d9b-4d7a-9e8c-cfc1f420edaf", "comment": "Malware payload", "value": "1cbf02008558bf8608bcc3f4edc76f3b4c970f3a692c3f72f0416401a6d520e3", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928097, "uuid": "f6dffcad-78db-4407-9785-af9700d0a765", "comment": "Malware payload", "value": "965a1054c87453af1ff2ff02190aa4d59051240e", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928097, "uuid": "f992f2cf-642b-473a-870f-5241cc88685f", "comment": "Malware payload", "value": "faa5e5f1c3a64efd729edb6b3067f62101552e7847373736407a2dae3c491e4daa4573e4a157a42eecaeff3ce26da7e5", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928097, "uuid": "6aad6cef-19a4-46cb-a707-d39676334ba0", "value": "T1B5272312AB3F8D2F4B58029AB17E4E8F77840F0500504DD790D7689EB8EDBF9662BD58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928097, "uuid": "b984c9fe-20a1-43ae-8573-1fad088b5188", "value": "49152:/s93yas93yus93y1s93yps93yIs93ySs93y7s93yns93yjs93yZs93yRs93yt8m6:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928097, "uuid": "bca9a4dc-f166-498b-9285-e0820864fb68", "value": 21851533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928097, "uuid": "f10e7bec-2880-464e-9b86-298e52b58672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928097, "uuid": "9d2860bd-5ad8-49bb-b4d7-a31916fb4203", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c136473-3f10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776947384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947384, "uuid": "6a012737-e0fe-4a40-9b6d-22ce4b0a8c44", "comment": "Malware payload", "value": "8e183a1a3e2a470831668a6003d11a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947384, "uuid": "315934f9-b294-4c45-94d9-3a4b53659feb", "comment": "Malware payload", "value": "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947384, "uuid": "c32efe0f-2c62-47b3-9e01-b58e122ee537", "comment": "Malware payload", "value": "512c7c40782f66a4c3fe4e7eafa7a46eaac0a5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947384, "uuid": "2c2f0248-d07e-49a0-abd8-ec3202bfca47", "comment": "Malware payload", "value": "8c1173f2640177acedc10445236427101355a088d20e705de8e749ce78cbc256185e21561d939ab474efd9c23621eb9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947384, "uuid": "b6e4fcf0-7d86-4b10-9bbb-c585f61a9dff", "value": "T12CA58E4663A501F8D577C038CD466217F6B2B4051774ABEB55A08AAA2F33FE13AFE311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947384, "uuid": "21c531b5-f167-4fb7-948c-fcc67e0a2ed2", "value": "17ef601722575b6cbe7be63d69dd832a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947384, "uuid": "5f596f2a-2c22-4aef-95e3-5dc7bf7fabab", "value": "24576:Vuktbb62N0QosBTdkM8pFshkQc6dgTEMBgrOHdnX6CWotSs7P/95IpLmLoy+PWZA:0BkFdWpF6c6dMsCHRX6CbSsHMSB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776947384, "uuid": "648aafd3-9bb6-4592-9fae-801c76d588fa", "value": 2162176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776947384, "uuid": "57a19248-4440-47eb-99ab-afdc2f01eaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947384, "uuid": "8092ef6d-d694-4211-8e58-a7f5fb2ca1dc", "value": "Built_Stubb.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adeb08d-3ef4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935437, "uuid": "0e6e0efe-b3f3-4734-8fba-983bc1fe0f86", "comment": "Malware payload", "value": "e21e44bb8ef5c019acfb226df78303ba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935437, "uuid": "fdd949e1-e769-4368-9c7f-2ee2d73fb560", "comment": "Malware payload", "value": "1def54444cab1fd17fe5acb42dd0d2293bcb9ce72a8e955bf6796d10d662c4ff", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935437, "uuid": "e0fd8a19-4b2c-4198-af51-0992c573a1fd", "comment": "Malware payload", "value": "2339d0d76172ee4c62aabda60423e289203b0b2e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935437, "uuid": "005bdf2e-e15f-4977-8100-b1f8a163be00", "comment": "Malware payload", "value": "8ed1f9b5f6a874fa776eedf444a616916f3f5ff60df9981e25af914a6a5f49313d3cabc6a1ab993cc6e56efa9ffb01e3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935437, "uuid": "6c1afa49-079c-448c-bb09-44840c780c59", "value": "T1B374234F410F1A535C03D5167A93F2069D83674B0AA86A0769CE8F73FA437E4DBDA4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935437, "uuid": "b243466c-be2e-441d-9b21-6f3f77e75bbb", "value": "6144:YNMzlNsZZW1A3wxs7fmw+PP2TMI+VnI2SQRfq4hjCexFOZwme8+ylFLns6pHmPi:YulNbyB7fmwA+TMxnI2SQVbjCmFOZwm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935437, "uuid": "4b1c752b-8708-41f4-b33c-ced4815c4ef5", "value": 343346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935437, "uuid": "9809ebb8-0e01-4b97-a72a-123cb8b69cb2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935437, "uuid": "c1a6f9b0-8bf7-4c10-8168-fd261b3d13b7", "value": "Strategi_AS_Referensi_April2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9bee82-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776964407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964407, "uuid": "d5c09dff-d08e-4144-a9e0-4e2055cabf86", "comment": "Malware payload", "value": "94e0a1a26906637746059243095e13d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964407, "uuid": "6bc8802c-901c-43d6-bb10-6aaee32a3338", "comment": "Malware payload", "value": "1f2775f955c1b1cd0c594b31d602600d1f1c8f0008496ec526d3d19c6e41ec7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964407, "uuid": "b3bcbc33-f361-45fe-be49-b016e99f6a63", "comment": "Malware payload", "value": "de9eb1fefd644501df5d4b264ac403b8e610d162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964407, "uuid": "401c8dd2-6d08-4429-a5dd-4072dfba81cd", "comment": "Malware payload", "value": "f37600136a53cc52d960293ece47babc7b4834dc658057fead65e2e4d55f62f5ed4bbf43b53a257a4a9ca4f67927b1cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964407, "uuid": "44d056e7-1761-4109-847f-a32c90d38e46", "value": "T126630262D416FE65E9649831FC3D81622390E21D49833F116B83B5ADBDAAB0D677CC23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964407, "uuid": "317cc843-2a89-47ae-a644-5b695959f393", "value": "1536:jckXnaNimS2VecLZHPoUvw9cpwrgWQasp1Nx0gL9asZ:TaNimS2VecLRPEGwratp/Cy9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964407, "uuid": "e6ff8ba8-2363-4fb4-8dd9-38a6dc87fc4c", "value": 66836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964407, "uuid": "d9f75c02-6437-4ff7-864a-e8f45960fe28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964407, "uuid": "1da3f256-b4a0-4e1e-b1a4-ac317fcdf4d5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4b18eb-3f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956005, "uuid": "f876d7f0-4c04-422a-b508-cf2add0d3a47", "comment": "Malware payload", "value": "95ba9c0109578dfea2d8b7244ef09f03", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956005, "uuid": "5d5056ac-7afc-4c5c-83df-9f31bb150602", "comment": "Malware payload", "value": "1f29ad9ef32cea0d462fd3d74d7bf439757b6de28039ee7c3fcd75b122a03043", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956005, "uuid": "5ab439ea-3e1d-4bbb-9479-430d8ebbb96d", "comment": "Malware payload", "value": "c9ae3b70a3918344c5af1ecb8377416316d86606", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956005, "uuid": "ca06f27a-b5b2-43a6-bd74-66c944d3abab", "comment": "Malware payload", "value": "1db73ee3af14f0908b80bc438004d2400c0a5fd18a7200b4272c25a654200e2dd152164f4bca49e5266cb56ba65c9255", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956005, "uuid": "d5df24be-c034-41c7-a76b-440263609ea1", "value": "T1FC763371FB7100ADE87790381DDB5395152D882FA983930B463ABBA79017BECC7667E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956005, "uuid": "4604831c-1f81-456f-8698-2ef3d8bd6076", "value": "196608:FW4iBYoF0m/qRrHhcrV1OYr8rYkdkqNXj1CtIM2BXg2g:MPjARrHw2DbNXj1CtIMwwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956005, "uuid": "7ad60f70-cfc8-4a41-8c89-d9f249df0ad0", "value": 7305598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956005, "uuid": "8455c476-3b54-44c8-80ac-fcc8c3d4f39f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956005, "uuid": "6b41de1e-adf1-4fc6-8549-01dccdccebbf", "value": "1f29ad9ef32cea0d462fd3d74d7bf439757b6de28039ee7c3fcd75b122a03043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acfa4e4-3eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776909372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909372, "uuid": "b439cc8d-3a04-49ef-b5c7-bbc722a10943", "comment": "Malware payload", "value": "b7f2e20520824fe9b7348af624d8415e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909372, "uuid": "0a053787-0340-4652-83ac-737f887821dd", "comment": "Malware payload", "value": "1f9776372053771242d928b8b23ecf92bc790760c8786d697aebbd26b5fe2aa0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909372, "uuid": "2921d478-0dc2-4a12-8deb-a967d838749b", "comment": "Malware payload", "value": "298d9381509be5de1fa1b903e36ddf17df1eb875", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909372, "uuid": "91487141-f308-446e-b99c-d523da5f3d1d", "comment": "Malware payload", "value": "1ca7c88056299ca154949a5ddbb752f1ae4601578cb8a2dd9a851c22df70c0918ffd233792e4e57c34f9b57d99c1487f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909372, "uuid": "baddf276-001a-495a-91c2-61111273e2e8", "value": "T1EAB09229A589C98B390655A75B72950C89A595802548EBABCB0287DD10F8A48FAA7003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909372, "uuid": "d69869a3-36a6-4729-a3dd-48679ed86b6d", "value": "3:FER/8ClVRK+pn2HoIkVViEaKC5sTrH77lLH2hn:FERblVR/p2IBnaZ5IHvla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776909372, "uuid": "e46d404e-c1f3-47d3-8a48-a2f22520425e", "value": 124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776909372, "uuid": "d4e6b875-f8bf-4140-a4d1-ea9b665b3e57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909372, "uuid": "776c022d-3f49-4b3e-895d-70c87256e4b7", "value": "$phantom-startup_str_591.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7cf11b-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954046, "uuid": "56f0d6e8-a4bc-437c-9a3c-18ab2f1b1933", "comment": "Malware payload", "value": "60138b3f2791742dd65bdf29376055e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954046, "uuid": "cb2e9158-3f3c-456c-9781-f55c2cfc4d95", "comment": "Malware payload", "value": "1ffc8bde92758bc0d2ddcc5a6bb78c73b6409429e52d62191f25afa8ebfad84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954046, "uuid": "28043101-d7a2-4cbe-aed2-96549a557182", "comment": "Malware payload", "value": "f6ade6bbdd1828add500aa82505567cf9f21efaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954046, "uuid": "3a6abbf6-bed3-4fb0-9b1e-7124e779305f", "comment": "Malware payload", "value": "2b168b1785371aed3f87f06a4242ef7770ed73849b8346254fc5a7df32dad39cf9a805fc241b3e0ce89039a0f8d99c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954046, "uuid": "24a80913-ef21-49ae-9373-8213779c1938", "value": "T18A643946735408E8F76783398811D585E6727C390AB0E62FD3647A366E332939D3BB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954046, "uuid": "b8f68001-e9da-4db8-b3b4-cb6e1dc3bfce", "value": "c6969aafb7744e2456439ee86554819a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954046, "uuid": "22f42a70-763c-454b-92e9-dbbe5352bbb0", "value": "3072:RxOb8VXWstpmWU/ya8UGEPzxP8EpwHUlHcTCuyuO/sOX52G99X6yoY46lhMAQG1Z:RxjtWGEPNP8Epw0lmEn0OplohRCyxzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954046, "uuid": "7a69fb6a-a825-4e26-9f00-425e0e643fba", "value": 332672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954046, "uuid": "987e7921-c3ce-41e5-a4f4-a52f9f4d654a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954046, "uuid": "f46bfef6-e1ce-4e1d-81ba-1042d9c646cd", "value": "Tax-Number56563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8555db82-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924368, "uuid": "34c99e5f-b63c-4644-9b2b-f0dbc3330cfa", "comment": "Malware payload (Mirai)", "value": "d0521263a1cbed32848402fb09f0af49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924368, "uuid": "1d6da618-1eea-4bfa-9c07-70b4069cf03a", "comment": "Malware payload (Mirai)", "value": "210e8a1fa9028c2033d96783b55ec1382f4d2348b5ee87e01ab1c45b781eae96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924368, "uuid": "0d7b8d2d-56d5-4e84-ba84-b5af0a0fb2a5", "comment": "Malware payload (Mirai)", "value": "22f924238b9789225c7f114d8862e38f14611d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924368, "uuid": "ebb733d4-cf3e-4f6c-846c-8e7387642152", "comment": "Malware payload (Mirai)", "value": "c9c8c3de5497fbddfe7499068029976f0847de30c66faf9f914a236f89df37c710f62947c56021a36b1579577348290a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924368, "uuid": "a3b65d7a-13fc-423f-a2e0-d7cc52406d38", "value": "T160832A46BC919A12CAD413B7FB1E418C372663B9D2EE32039D215F6173CB86F0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924368, "uuid": "c83a74e8-a393-4b7e-a739-de798aba72ee", "value": "1536:QiIhBaGfRYL8kYdHRw1ODcxKBWHR1KNtlLIAVFFxE1XBcI:QiIhBa2RYzpJ9R1otlFV1ElBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924368, "uuid": "9e69cf66-ee8f-4055-bd85-790c0c9cd3af", "value": 87360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924368, "uuid": "6b671294-6fb5-4674-89ff-586cc9202f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924368, "uuid": "d52d0b51-71a3-4a9a-93db-e0799dd125ec", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff3cd1f-3f6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776988059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988059, "uuid": "2ab5bebd-0ed1-4a00-89fa-757184774781", "comment": "Malware payload (Mirai)", "value": "ab022e4370fd2e8f4239e525d96d3f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988059, "uuid": "e504a6a2-50c2-4def-8c5f-2fc0012f5407", "comment": "Malware payload (Mirai)", "value": "213eac16b7f95a7539b2c21766abaacd6f37984244627583ba155dbd7b9bd6e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988059, "uuid": "11309d0c-8e18-42d1-89bc-daf47381b718", "comment": "Malware payload (Mirai)", "value": "c4d7f18808923326832da3895f80fa2ebf6aa9d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988059, "uuid": "277b2e2b-c272-49f8-9dec-659b7574b3dd", "comment": "Malware payload (Mirai)", "value": "640b8af57be36ec09832e0040983cd73b60fe8e20531f6fac718ac150ef5cdfdbbad1beaa6efd2b79f61b5bd861d5f0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988059, "uuid": "ca109873-33be-4fd6-838d-d8c64dee857e", "value": "T18EA3D52B7B130E23C0C620B552E30632F5BADF5938B84697B8A07C9D6F3998435567ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988059, "uuid": "772fa367-1503-42cf-afc3-7e1e0e043134", "value": "768:42iHriP3BC8Cog4C2wYyD0TAOsFqXpoGPshm2ln0mwtD9QkPO+N95VQcm0LEtpI8:AHriPHgBMnU10mwtiQN951gGt39xvsrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776988059, "uuid": "198b7fce-adc6-40f2-aacf-97eeb314abd1", "value": 103188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776988059, "uuid": "755b7bc8-f2ea-48da-bbbe-1c994a61e0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988059, "uuid": "8fb3081d-f60b-49d1-88db-434938ac16a6", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea361776-3f06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776943435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943435, "uuid": "36539148-d50c-431c-95ca-18930c3c3bc4", "comment": "Malware payload", "value": "4f40d82b70e61874718025fbb2b7cd7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943435, "uuid": "e8b8f108-e0e9-49ec-865d-35955f6bdd12", "comment": "Malware payload", "value": "214c8c0d7c6e6fb5a9d88f2f4057f9277070145b970f3b16aea57d5932985233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943435, "uuid": "16b7ac99-68f8-451c-a79b-9a53e1425397", "comment": "Malware payload", "value": "92f72060f1782bfa8acda459aaf6b0c276b9cf09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943435, "uuid": "d6ae22c8-d205-4ad6-b95d-f04c1d2b178a", "comment": "Malware payload", "value": "c260e7b27b280479f5a0993d4f30cb6fcf02b160662d3f9745427e89e9cda9543a8a4d96e2b400c5a9a1977c06294e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943435, "uuid": "e5d36b78-c8eb-42f9-909d-8f321f1f7830", "value": "T1BF083320459361B9FFBEA5BF07D22731B7B88CBBD439298A518CB254F4E5445209CFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943435, "uuid": "eb123245-755e-44b6-a49c-6b9d0a4546ae", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943435, "uuid": "fb334e59-1dfe-46d2-b76a-38d6f4237535", "value": "1572864:Rt9IKPezRWY5X/QRq52c72UcT0078Q8bF1Qu1QPqmtVsxztjGG7:RUKGzRWQvQI2c72R77j8bFzTbRjt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776943435, "uuid": "c9699cb1-2a8d-4e1f-8580-d244efc2e27a", "value": 77451876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776943435, "uuid": "2d392812-bb68-4d60-ab21-a873f5976533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943435, "uuid": "aef55d85-f4c2-44cc-9009-c7455e199218", "value": "Cryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b97c7e9-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928056, "uuid": "27392716-45fe-432b-998d-f4ca2be67a6d", "comment": "Malware payload", "value": "c29dc971f755c0ab281b48d05c355610", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928056, "uuid": "49a92f18-3055-42c2-874f-9fffae303830", "comment": "Malware payload", "value": "22012c1a4a2f062a6b3af6fd34224d785b8ce1b1655a85a0154b1c067416b26f", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928056, "uuid": "f4807cbb-7052-4b4d-9278-50e66273310a", "comment": "Malware payload", "value": "1938231e7032862b3ae70936c676c41e1c6c650d", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928056, "uuid": "d93d213f-970e-4fea-a97c-c71bddbcda2d", "comment": "Malware payload", "value": "8cfd236ea58dd0aaecc2df239bb7a59fe80eb2e928cf4b0b7452c330c0f205fad92ca337d8d530c0eb2316c24817cafd", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928056, "uuid": "ae7e3b5f-a998-4f79-aac4-ac53fbae2914", "value": "T1AB27232A4C9E9FCE23DD2948357F1E0F3BEFC812402195566DC038C7E9DBDA6129A1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928056, "uuid": "6b30c888-edae-476c-a9f9-33c3fb87039a", "value": "49152:gNYc/zANYc/zJNYc/zONYc/zcNYc/zPNYc/zhNYc/zbNYc/zCNYc/zMNYc/z9NYs:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928056, "uuid": "19e8e569-0020-4e00-9ae4-158e520913b6", "value": 21851533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928056, "uuid": "e3267268-eaa6-4697-8599-6a972b011f75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928056, "uuid": "d45bf3ce-10b7-4608-8268-c903a1ba7c1e", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe64223-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968302, "uuid": "b60213c3-cada-439f-9c5a-a6e57423cb13", "comment": "Malware payload", "value": "7fbe41b3e514f6235a38dc6b98ff3f0b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968302, "uuid": "cbd693d9-377c-4826-9500-b5444eead7df", "comment": "Malware payload", "value": "22b8e11e8ec946800381942a33b8b317747d14e697cb32e426f3e6fbb5c8ab3b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968302, "uuid": "2315a5ab-baf7-474e-bbe5-917a1740f32d", "comment": "Malware payload", "value": "3bdfdd15681aefda9471ef01ab3d015e7b08c6f6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968302, "uuid": "15c08c14-783a-4e16-902e-cf0e561ad15b", "comment": "Malware payload", "value": "0eeaa8d3ae8835c31382494d57761bfafba78790161a720593f8b21095ae83a2b229e790ee45613afab7ddab5a983011", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968302, "uuid": "9a3d13dc-a310-474c-b8bd-76018cc8b089", "value": "T1A506F186FF59952FC8B700724F66837532969C128E829B476858332C6CB7ADC0F5DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968302, "uuid": "5eb1b3d9-9334-4938-9730-4f0fc25d96e0", "value": "98304:YfEuCi5j3Z0DJhx/G3ndh8JWuqTJ3+MEy/:YfEXO6dm3dRHEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968302, "uuid": "2d87c90a-66a4-4559-b3b5-689072ecc66f", "value": 3948350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968302, "uuid": "91e83569-afb0-4e6c-ba6b-28e31f0e0a85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968302, "uuid": "a816e50e-146f-4fc0-9bc7-dcc290821bbd", "value": "22b8e11e8ec946800381942a33b8b317747d14e697cb32e426f3e6fbb5c8ab3b.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc9de88-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776912380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912380, "uuid": "33a97627-0ce7-40c3-b146-a55dfe1acb23", "comment": "Malware payload (PhantomStealer)", "value": "9cff319d04fe3ad5b7afdaa1c33aaa08", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912380, "uuid": "52cad443-de1e-4803-8d54-bb8bd89261f8", "comment": "Malware payload (PhantomStealer)", "value": "22bdb406f852375a0dec9a309d923d39f3e38f7b465fb51ea0710d70b9eb3ba8", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912380, "uuid": "99c58aee-4441-4682-99c8-4db6071ac722", "comment": "Malware payload (PhantomStealer)", "value": "40147a62b1f6bdc19a9db059f1c896495f65e12e", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912380, "uuid": "943e6e06-abc6-4c50-b06b-4c6fe10cebc4", "comment": "Malware payload (PhantomStealer)", "value": "e88958960f104cc5ea623a8a251a4519501e6e79321a4fee201a29a40d5014d61f6eed5454804ab616fe66ff0494bec1", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912380, "uuid": "9bf5b1c4-da21-4388-b9b3-4e1b0cdb64f2", "value": "T10F0523389BBB986DC7AD52BD74FF9F858B8509E204DC7EE571F2B0435296301883AD24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912380, "uuid": "85c40cb1-2cb5-4ccf-bfa4-d92646284c95", "value": "24576:yU0oN7mf/26nCQulvCtNWryhggmmpi3uhw8+yc1V4kM:yA7m7CQOvCOq3nhcUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912380, "uuid": "b8ea5651-e5ae-4199-96fe-46fe46496b7b", "value": 840380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912380, "uuid": "98c3cb24-5740-48a8-985a-89ef0bf85443", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912380, "uuid": "28764423-6fc7-4b53-b976-0a17ea8c4865", "value": "Jump.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d7e7d1-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776938146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938146, "uuid": "7ff12cbc-d1ce-479e-a072-794e77bce8e6", "comment": "Malware payload (MacSync)", "value": "8a315d255e318eb524301a6259da0a05", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938146, "uuid": "d456fb9f-65f8-4d12-ac13-8006edc19b68", "comment": "Malware payload (MacSync)", "value": "2302639595cb41ec36598359599d85eff307864ff63fe9c7ef9c72bf3c00f96e", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938146, "uuid": "e5b950db-d81a-428b-b1c9-46544921b008", "comment": "Malware payload (MacSync)", "value": "942858f57d8f24b9539da2f1526e0df3d85d668c", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938146, "uuid": "6b71fd9f-caca-4608-9afa-da7864bd8f67", "comment": "Malware payload (MacSync)", "value": "dd5f45602ea7a8355650fa875ab5a87668a4a4a6fc6bf93e20448cc1aa5eccc2c743abe62020c7475ecb26fff12d360b", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938146, "uuid": "94415148-e80b-4ec9-b0f1-42899c92e60f", "value": "T127953389425A134CF53C30618577D97A6FC2FF526C841CD66B3AFA48A699E7C7F0A80C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938146, "uuid": "6d4e3d96-6b26-4ea5-9202-6bcf7a9bb852", "value": "49152:zevKsD/8xnmtCuVddh6N80F9Lv7TWMSAQ0GhQ0maoy9+sNChKajFHqW:yv5zMmJVvsNhF5WMSArGam+sOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938146, "uuid": "6f9db95b-bb67-497c-ab71-0af88950c669", "value": 2030023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938146, "uuid": "e1482031-d8de-4af6-bafb-a8058f0a8215", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938146, "uuid": "1cfc2f09-5744-4a3c-b489-59824ba233ce", "value": "d6ee79d12ccb3b74179e0b70ea9a826eed12031146b789b0b7c60b8536d683df.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2060b415-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985187, "uuid": "dc78dae8-cd7a-4ad6-8063-22c840944ee6", "comment": "Malware payload", "value": "9e45d86623ceec8bb0266367c28491ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985187, "uuid": "5a8c76e4-d269-4e0a-801c-1e1ed0a106ec", "comment": "Malware payload", "value": "23c6d012a7ad37fa23a66b0699191ea750af13ce754883b558f2ff42cbc85911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985187, "uuid": "c3d29761-c036-4642-ae10-12a312679498", "comment": "Malware payload", "value": "50a74bc3b2c4dc5ee59b079681dd8bba351078c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985187, "uuid": "4b684b22-2c20-489f-92e8-b3e3e158c542", "comment": "Malware payload", "value": "d72e21af9106e8f8a2f86badcb419b187effe7e48002f69c87fac19ab5a2e430d95d168a1ce5b95db187bd029dad1c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985187, "uuid": "4409c024-ada9-4d37-af9e-2b44c9b93421", "value": "T1F5731B46FB43CA77C80311F101B7AA6A4A31FE3A4C329D8AF3647DA4EB364C16619775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985187, "uuid": "8e3e94d6-dd5f-4f3f-b241-8906f51c7025", "value": "1536:YIw1PW2HmzGAiCtP3GbWf8vZmad9ZitJqMdC0lwJgx:YId2GzyCtL0Ead9ZitJqMdaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985187, "uuid": "0a24f777-c2c3-4321-a383-430c9a8ae012", "value": 74556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985187, "uuid": "fef4ed1f-1992-48da-84ac-7fa4bcbd130c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985187, "uuid": "8f52e299-2a12-4bfa-a407-9da2cb2bd426", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacbdecc-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "72c1401b-73a4-4a20-9752-90645ea8757e", "comment": "Malware payload", "value": "9084ee1d5f4f40780934d38624a94e5c", "object_relation": "md5", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "83b1fbfe-a867-4e42-8745-c38c6c1f1ccc", "comment": "Malware payload", "value": "24bbe790298a9463b3754442b1b8217eb0701b7151dd928686d3dc4e9777ba48", "object_relation": "sha256", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "df44c45c-cf41-426f-b2e2-222a7c0d532a", "comment": "Malware payload", "value": "66fa6b6ad4fddcd4ba6b3f10de74603a0c2af45e", "object_relation": "sha1", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "9e6b1c02-c534-4ad8-9c9d-c803092c71e1", "comment": "Malware payload", "value": "0431e2fd89fe90bd51d710ea94f8d4341309c73900bec2fa1a547ad0e5761cd1e38b2eaeaf94f615b45d79ce0ec80ba7", "object_relation": "sha3-384", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "5b498672-c798-49fb-9118-77c9fe462c9b", "value": "T1AB857DE9DB449358F1C03A2EB2360212B3FEB9A9A6F5A383D233673A355E047550535F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "9be26a03-6d27-423e-a775-08987c1d5284", "value": "12288:0XSVw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFmaj0GlAMSvc+i:0iVwAVwAVwAVwAVwAjFlAMSvc+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924485, "uuid": "e01526b2-fb61-426d-8f42-9aa939a470cb", "value": 1766071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924485, "uuid": "50126acf-03d6-408d-9c04-935456a88a3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "42b646c5-9c8e-46ad-8386-6719db1c931d", "value": "24bbe790298a9463b3754442b1b8217eb0701b7151dd928686d3dc4e9777ba48.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc728cc2-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload (Emotet)", "timestamp": 1776944647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944647, "uuid": "c6170593-044e-4fa9-9e80-4b55d20b5c1e", "comment": "Malware payload (Emotet)", "value": "803385cf25070740f5b09e685d2f531c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944647, "uuid": "f758d701-4353-4457-b6ce-26c27b236d9c", "comment": "Malware payload (Emotet)", "value": "251037ceebfbacd419b663ebcf0e01ec80a2c46dbfc85f66492c8585b481fb8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944647, "uuid": "24497e92-3589-4174-a22c-0d1e96cabc3c", "comment": "Malware payload (Emotet)", "value": "5143c2befd448fdbb0bb5a7304659fc1d3bddcb7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944647, "uuid": "c936041e-711a-49ff-a2b7-37f89aa7a92b", "comment": "Malware payload (Emotet)", "value": "9c3dbdbde47473a4fc95479cfc8dc818252d95b255053afcc35ada4bf83f09a2f43bdee748713591fa89b693c6ed98a1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944647, "uuid": "48d83657-19d9-413a-ac0c-f17b739b4c24", "value": "T1A5B6BE9BF16A2FC5E157007ACC625187B65428A44F05CBE3B09CEA32F7036A56FB871D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944647, "uuid": "fccead87-5bf6-48d5-a3b0-e68d94f06f0f", "value": "32adf4487a233e7ec314d5edce298b50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944647, "uuid": "5d705bb0-577f-4d0f-875b-042bceb610b6", "value": "196608:k4SCTjKEzG5wRrkPTCpbEi8rjAPlNICsPLRbEdUxoNChqu+S:kOjyo8Tx9YtaNbEXNChn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944647, "uuid": "58352259-981e-4382-8555-9d134e2e3446", "value": 11136000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944647, "uuid": "86a47a17-4f75-4676-8c46-a9d9d9f8e186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944647, "uuid": "7c4f6f9e-4f80-40d1-a9ce-e8f453790a1d", "value": "stage2_payload_20260423T055308Z.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24558fcc-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776925064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925064, "uuid": "0581ecdd-d06e-4579-94f0-0e12556a4f13", "comment": "Malware payload (SnakeKeylogger)", "value": "95b4eac2bfba95789ee1cc6b0fc6cbb2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925064, "uuid": "81ac2edd-e2d8-4f2a-8af7-e8ec985e1280", "comment": "Malware payload (SnakeKeylogger)", "value": "2525aba3aa0c6896fc70910540eeb06f0df4b23105e5ee521bce057d6e41c8c6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925064, "uuid": "e4c3f7e6-6c1a-42e6-9def-6ed58244ce2b", "comment": "Malware payload (SnakeKeylogger)", "value": "da5dc310fc4beb1cb83f788e91ff6fca3c508b17", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925064, "uuid": "f7f42e19-a4c0-4533-b820-89a624d00956", "comment": "Malware payload (SnakeKeylogger)", "value": "71456e00acdc9ebb4eace47c26bc969e99ad6c1a3978e0f4ec09e210aac9078ca3a8fd02acb651810523bbea666fa54a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925064, "uuid": "84c5ea36-474b-4ad3-a77c-0de0921559b4", "value": "T1FD022938AE5F818FE069C24F3DC9095F9516C63FB909511820FB9E46F5C539E826BAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925064, "uuid": "de1c8deb-89a9-4e9e-a6cf-8631bd0f5311", "value": "192:0jDpr7a8L808X8a8z888r848a8q8l8d8r8N8X8s8L898r8R8V8L8a828N8a8J8w2:0PvYBiPSDkn7uQi0Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925064, "uuid": "76cc757c-af49-419d-b7bd-e6ff465aad5f", "value": 8851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925064, "uuid": "54004746-3e56-4cda-86b1-14d769f9a225", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925064, "uuid": "18a99dc8-dd50-48d8-978f-2684321039ba", "value": "RFQ_ORDER02384334.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38836737-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944855, "uuid": "3cf9148f-e88e-4121-b7e8-7679af5509ff", "comment": "Malware payload", "value": "fa5c9350a9b2f4bb1b4a742d1a4f6867", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944855, "uuid": "0b90348c-3705-4747-a00c-14e2dafb10ad", "comment": "Malware payload", "value": "253966fc2db2fa0924fdf413b8d3f071226e1b6604bd4f8e5a2860e579b77481", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944855, "uuid": "1a8df058-a117-4680-a88d-7fff9576a541", "comment": "Malware payload", "value": "8582a2bc4fdf5df30bb29d294074a91d4fb56fca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944855, "uuid": "9ce032a1-b2e0-408b-97d8-947a56d10088", "comment": "Malware payload", "value": "4ac0608b96db11cf6b94c9bcd391cb2e350b41bea1bf12f05508a40a93a181d1ac8183e7fe6d070f3ab26672ef2756a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944855, "uuid": "fb795fa1-91dd-47cd-8bf1-bc8461be5118", "value": "T17D713006DBE85227E4F60B78BEF3832356B1F8409F77572D09840639AC617A81976BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944855, "uuid": "c112f152-7de1-415b-8438-ab83a2e880e8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944855, "uuid": "d3a3bbb5-64f0-4188-8132-ec56995a9c3a", "value": "24:etGSkm9Rzt3hq3Sd6Oyyl+q1c7AyLAztkZf35mopFDpWI+ycuZhNOGakSBXPNnq:6vvfkqiJLASJ35m2s1ulva3Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944855, "uuid": "11a72c8d-eee8-41df-9d60-5a0c40ae124a", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944855, "uuid": "7c43d52b-9593-45e6-8d19-0de56846193a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944855, "uuid": "f0fff6f1-b927-41ac-95bf-9ecec0b343af", "value": "yslb0c5w.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25df6500-3f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955991, "uuid": "7383950f-9c6c-4465-ad12-493a33e07164", "comment": "Malware payload", "value": "a6a4a290ebaa27e661839c1e98caf2e0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955991, "uuid": "0e915105-8ee1-41f3-90b8-a3ab05e7ddaa", "comment": "Malware payload", "value": "261305ccbee49fc67c13d275e5788fdc3db8b6a85ec99de16130be93130bcb19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955991, "uuid": "29c5da6a-528c-4cc1-ad78-a70b76165c7a", "comment": "Malware payload", "value": "8375d7b2eeb8e0efc1afe660d2fc2a97af58c740", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955991, "uuid": "469ce226-d83a-4245-aed7-4769de851cba", "comment": "Malware payload", "value": "585ef7110fb49cfd23bec07a63ac48cd0f0b2561467acf3c99189679dff45ee20c7388212462b2782077e5e62e95a6ed", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955991, "uuid": "d423da1f-0474-466e-8c4a-1aff8a521980", "value": "T1F2563361E37042AEE87750390DD61391B47D9C3FCE829347473AAA9B900BEE9CB527D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955991, "uuid": "fa9906c1-c742-4dd8-8872-a9b2ce662578", "value": "196608:yv13ddW75F0m/qRrHhcrV1OYrkNXj1CtIM2BXg2S:yt3dk75ARrHwaNXj1CtIMwwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955991, "uuid": "64408505-db47-470b-bee4-5cee1d9101ca", "value": 6420398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955991, "uuid": "2e33958c-5f47-443d-91c2-d0453580e41a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955991, "uuid": "e6944e1a-d8fa-4782-8233-d31e2cd30839", "value": "261305ccbee49fc67c13d275e5788fdc3db8b6a85ec99de16130be93130bcb19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b53ebfd-3edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925667, "uuid": "557ed3d7-84dd-4f50-9da6-36dbcdbce964", "comment": "Malware payload", "value": "efc8064c7f7c4d25cf8fc0b7c0160539", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925667, "uuid": "80bbf622-b7a4-456a-95b2-a38bf0509fa0", "comment": "Malware payload", "value": "26151e6df5ac089a79eecf4032e375e51d50b319ed671c1dadec522a945c9264", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925667, "uuid": "e43fc465-29ef-4166-94ca-650fe8bc231a", "comment": "Malware payload", "value": "bf885feb980e056f29757a9e96e07e133ef8148f", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925667, "uuid": "2fbda2f5-534f-4319-a2dd-c495c4e27324", "comment": "Malware payload", "value": "4905acafbebc05ba47ec94484315fda500eb06e6cc89bad61d1ebd0aa38301fe4455f5995bd2f34ea54bef26518d1466", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925667, "uuid": "ac96e17e-c8f5-4772-8b54-095a28b7f088", "value": "T105333E31F7EBEBD89B07994E847E3C77570422C122C492A758674E86D648F3A26037BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925667, "uuid": "d7a0b276-16ac-4046-94fa-58591cc94070", "value": "192:oelGV4IyXu9G4oknDyvasgYUA6QlA8CAFS2WxxzbCyLLxRyhyopq1XL3ucJ:ohcEG4oknOvaJV8K2AzbCynxRykJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925667, "uuid": "f67e8fde-a395-4ee0-b90e-10c3501a0632", "value": 53710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925667, "uuid": "60eceb8d-4bdf-48da-a796-21acd5618254", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925667, "uuid": "a403222c-e48c-4354-aae9-a2af2a973838", "value": "26151e6df5ac089a79eecf4032e375e51d50b319ed671c1dadec522a945c9264.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add6742a-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927872, "uuid": "eda3be05-183d-4117-a5ab-6c56124c03bb", "comment": "Malware payload", "value": "d82780d076c21970887838c6497f8745", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927872, "uuid": "291ab98f-008c-454a-9e51-809abfadfad5", "comment": "Malware payload", "value": "261df901caaea82cdf00780d16c5515e931bddd41b730247df10bdc447607e42", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927872, "uuid": "93ac9b81-5fe7-438f-b203-39212b39a2f7", "comment": "Malware payload", "value": "f36201081a1498654f8a4039ede83cc7cde47653", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927872, "uuid": "1de3576e-b4e1-44a2-accc-940a04b52896", "comment": "Malware payload", "value": "babcb416ba18300225921da6f332f89c9f036ddd56fd8a52711684bc9e6528052bd3a24157682698c27215513085fc45", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927872, "uuid": "970f9a89-c680-46b1-9c9b-8799c58458e0", "value": "T1553723139E3D0F9A029AAAA414AA1E5FCDE58DA61C447DEE87F3713E047FC0E6354358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927872, "uuid": "d4e63d9d-58d0-4f40-841d-153b5da08076", "value": "49152:5A5JA5tA5gA5DA5VA57A5FA5qA5KA5TA5AA5BgVA5fA5vA56A5LA5vgOA5XA5/A/:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927872, "uuid": "1a65d10b-43cb-4653-89c6-1ed701396094", "value": 22811575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927872, "uuid": "c5045f40-11c7-41a7-8ccc-6c3a28c0562b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927872, "uuid": "cafc9e6d-e2cc-422d-ba76-3bdd3415945b", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bf7165-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926518, "uuid": "bc07d114-5be5-47bb-be57-69dd31673937", "comment": "Malware payload (Mirai)", "value": "7bbe22804f237d3693c4c17476d1d583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926518, "uuid": "c04b4d3b-9504-43f0-b1a5-e24c1b9e451a", "comment": "Malware payload (Mirai)", "value": "2661887f7bbbf424b1e89e51d76049610e1b62d051300a15a1bdd03087170b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926518, "uuid": "b1e174ec-52b1-49e8-8fe1-baa05f083643", "comment": "Malware payload (Mirai)", "value": "9cdcc898f2f6790810835bba34e14bcbab1b303a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926518, "uuid": "51d635a7-7cdd-44d6-ad62-cb561c699662", "comment": "Malware payload (Mirai)", "value": "d17a92ce04d4cd02de3e80db9e936ff67f826c8a532e80444400d767623ab0515d983581b1bb8319ee44e3d07765c55f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926518, "uuid": "12fc52be-8e33-4caa-9465-66278dae6c26", "value": "T1DED34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926518, "uuid": "b12dc684-6f9a-4091-bc46-8416e24dc8e0", "value": "3072:loldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3j0A:KPeCK9kzivVYQitymTT0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926518, "uuid": "35c4f9ba-0f64-4892-ba77-02a28921f98f", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926518, "uuid": "08c7f532-820c-4a2a-9ff7-621a2c07ad3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926518, "uuid": "8b34205a-bcf7-435c-87ba-137705a695ce", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340bc6f2-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928527, "uuid": "42409995-c8aa-492a-af67-cf195a9bb312", "comment": "Malware payload", "value": "473fc042b56e2f824cc475f46de0b777", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928527, "uuid": "2ae88bc8-76de-4c15-b8d5-6666ea91f6c5", "comment": "Malware payload", "value": "271870961edfc3e6c2570e5168553fa444fca6e374bba72aed0a40dfea22cbaf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928527, "uuid": "d892ee6b-f67d-4ea5-91ff-7527842356f1", "comment": "Malware payload", "value": "ccf6ec1d6e1c04bbefad83a4e561b21fb753db8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928527, "uuid": "2b50b4d3-2364-4e0b-a721-b22e6f513125", "comment": "Malware payload", "value": "997d85b71f7182d07faf9784c51b9fbcbd284dba999d44ac43fec2519c837d9dfc42632d1054c3fa4ca720c88cc4e72f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928527, "uuid": "f6198de7-b3ed-42b0-92f6-6fdb4b7a624f", "value": "T152137D6956817C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C59ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928527, "uuid": "15e00949-6de7-4063-97e8-fbcf6e5e57d7", "value": "768:bc+jnL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bc+Acy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928527, "uuid": "2a6c1804-cded-46e3-b1ad-256bd8059210", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928527, "uuid": "df1fa51d-83ec-4a76-ad0c-3fe7615a9e36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928527, "uuid": "5e1dcb8d-7605-4411-bada-3f0af875b704", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb544a70-3ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776915010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776915010, "uuid": "fc555536-97fa-4d5d-a724-47ef0c2e6788", "comment": "Malware payload (ValleyRAT)", "value": "33b0c9f1f4763c22484f4dcef739432f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.saf", "colour": "#0C60FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776915010, "uuid": "cc687656-93ff-4a3a-91df-b24ddcea9f38", "comment": "Malware payload (ValleyRAT)", "value": "2739c9cd5236203b885788d50f5562801da50ea2cc512290f2dd9bef7ef9a089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.saf", "colour": "#0C60FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776915010, "uuid": "34848f9c-127f-4c33-9d4d-238e0eb12988", "comment": "Malware payload (ValleyRAT)", "value": "b0bf6723b887fcc1f06b35d3f2e9d6924e235ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.saf", "colour": "#0C60FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776915010, "uuid": "e67f1e26-e651-4edf-bbe7-cb129764e218", "comment": "Malware payload (ValleyRAT)", "value": "d2648507a31b59f05634eb3909294f63b6d66b8dce20da0257971ce9bfd9e5837afc4a00d1382695797e260f3eaa2f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.saf", "colour": "#0C60FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776915010, "uuid": "df497c9f-63cb-4fed-b456-0a0971e02f8c", "value": "T1B546AE69A3A400E9D4B7C13DC9979927EBF2B81513309BDF02A5927A0F236E15E3F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776915010, "uuid": "974e0c63-dc2f-4d1e-aef6-1096eca3967c", "value": "31e261e28fff289b9a6e5e88d8a5656f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776915010, "uuid": "1528e4fd-e85b-4c7b-8182-af7b65d1c9f4", "value": "98304:WW+14cahejHZ18uMJhtZ9639eoCL5kr5q:1d3UjHT8uMJhX9Ho44q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776915010, "uuid": "31059aab-7ff2-452a-9758-472a5d44cabd", "value": 5816936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776915010, "uuid": "10b2bcd6-a246-4e95-aec2-410c3854f56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776915010, "uuid": "27e04c3f-bfc1-4f39-8616-0b6671629ba0", "value": "2025-11-11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b72cf4-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776929580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929580, "uuid": "925d61de-4476-4254-b856-15cd37dab9d2", "comment": "Malware payload (ChromElevator)", "value": "6f48d9e73f48bdbc4aa618dc5071e4ae", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929580, "uuid": "058c0a53-b1c5-4944-b722-91ab00eff0e2", "comment": "Malware payload (ChromElevator)", "value": "277d854d673a527000f9a6485e568c05317c032937be06462d144e96976ab8eb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929580, "uuid": "8e039ff8-6256-41cf-bedd-57815dfa0ead", "comment": "Malware payload (ChromElevator)", "value": "d22666043fe09f883af542dd6ede769b6e093269", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929580, "uuid": "3333ca2b-d244-4426-94d3-8f256e038384", "comment": "Malware payload (ChromElevator)", "value": "0bd3574dd00b5a3f013bc53cac0f350476c9490f1b0bd81b871820c43924aef2a13f96f17ad0fc0d884d74d06ebc6760", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929580, "uuid": "5954f46f-d38c-47c8-8429-2be4d609c46b", "value": "T16BD3E013C8C83FBECF78663440BD221E7781879F555A658AE733AC4EAFAB180561E0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929580, "uuid": "21283c8b-5aa2-4bd4-b046-c4ba5f6d8182", "value": "3072:EKJuiwUxhgltdkWbDZg4dYaxaNRxhsga1GRAFC8XT3L/hs82i6:E8fglwOg4iacNFsgjiFBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929580, "uuid": "af59286a-4342-4aca-bbda-015557c37e07", "value": 139186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929580, "uuid": "8a9cdfdd-3e61-4214-b46d-19960d7f3dfc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929580, "uuid": "f08484c5-a420-47be-a390-0c3d9fa3672b", "value": "Customer_Payment_Advise0238459.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a01574a-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927812, "uuid": "ad7d9c2f-e005-4ef5-b1e0-c85622e520d0", "comment": "Malware payload", "value": "9f8c2fa6d0b4d578a9bd0dcf0a29ef1c", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927812, "uuid": "88b8fb2e-e2bb-4058-8fc5-de572402175a", "comment": "Malware payload", "value": "27d702c59d8a881f6de7e8b93031a457b83b2486d289d242c513b8cf99b46f5d", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927812, "uuid": "aaee7076-4a62-47ad-93ce-c1db1be96e26", "comment": "Malware payload", "value": "45e5002281f07d9be7e02ac3b50145d75a8cfde8", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927812, "uuid": "fcfed5e9-8f6d-4eae-9130-22cfbace90da", "comment": "Malware payload", "value": "35293c79374cdf294d8a2b02d764d676d346a5f6fd69eb30591de5f7e7fef121f3554d6d9dc9f016b0b3ff297a6dfe05", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927812, "uuid": "d3cb788e-a8eb-4b82-bfea-b0f6edac50e6", "value": "T1862713865E5EEBBB019D1BA87C35029D47F60E0574621CCB85E6408A4EFFF9B38D9438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927812, "uuid": "172da80c-2485-4620-b267-43281f720f4f", "value": "49152:RTsItrTsItfTsIt0TsIt9TsItnTsItpTsItNTsItPTsItWTsItrTsIt9TsItOVm/:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927812, "uuid": "ed7e7419-99aa-4927-953f-79e18546214e", "value": 22091548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927812, "uuid": "b3a5ac2a-ebb8-4d62-be0e-381860214e76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927812, "uuid": "d30d4382-8b98-487c-9563-4c7c1ff1b295", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f549130-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934183, "uuid": "8de467f6-40b7-4876-8c9b-d7f5e2ee4f41", "comment": "Malware payload", "value": "3ea526ca635e529084a7b7fd7a4976b7", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934183, "uuid": "82547fc9-d8ae-41c9-bac8-5a2daf1cab4c", "comment": "Malware payload", "value": "27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934183, "uuid": "0cdc2931-8d21-433d-a46c-6cb2604eff2e", "comment": "Malware payload", "value": "2c8db80192ea6d063c0851633305ebd31923be28", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934183, "uuid": "a17b417a-b82e-4f19-bb20-65086833dd48", "comment": "Malware payload", "value": "619fd0e65c56f1b6b852178b6b1f66d8dff4bd68dbc3bd999b738a7b411119325bcb2938433fcf901a39fafdf38f0d41", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934183, "uuid": "58af2181-103b-4d7d-be5c-34e4c487ef02", "value": "T1C0555C347A422DFB5BB820C248C6851C563C2279DA682DF57ACF0C922F0D77627B79B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934183, "uuid": "f6d4c17b-5d9d-4dda-a712-32a563addc49", "value": "12288:uVvUV1EQmkuYA5cq5O140EHxfQrqLlwrxbzT89BJ+9GFssSxggiK/cYj5l0B57t1:uVgbDGwqNSDiK/cYj5l0BTnH89G6nOue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934183, "uuid": "e4ff067b-a56f-4a73-8f7b-4f5475893e24", "value": 1292705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934183, "uuid": "cb7d514b-026a-4d6b-b12f-2c081937ef5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934183, "uuid": "1cb4bd1b-10a9-42ca-a934-97aa24b505c4", "value": "27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d7e6f5-3ef0-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776933798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933798, "uuid": "0040e363-c33d-422c-8edc-e8d421a1e3f2", "comment": "Malware payload (ChromElevator)", "value": "ee71b1c5746bf35f811b9dfabe9a0801", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933798, "uuid": "6a491b0b-68be-4aaf-bd38-daf3eb3a2675", "comment": "Malware payload (ChromElevator)", "value": "28ca2c00c4e2e5e9a7a1b469c264358fff209822a9dc0a74443e1eb0eb11b315", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933798, "uuid": "119b8ee9-1bf7-475f-9a2b-e5e97fc92108", "comment": "Malware payload (ChromElevator)", "value": "f01e89ef920ee4c2ff6a75f75f6e8bf97ecd889c", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933798, "uuid": "5a77716b-71cd-46e3-acb6-3ba25e634693", "comment": "Malware payload (ChromElevator)", "value": "b574ced4af7a3f73b36561baeef8a2eaa0b8f0cd8695a449e3b690c0fccf750ce5b9f96991ae78a1470e45d94ccabbe6", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933798, "uuid": "925e5356-4b4b-4a6d-bd7b-dcf404fe46d6", "value": "T187D65B57E9B551E4C0AED135C626A522BB713C884B3023D72B90FA342F77BD06EB9724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933798, "uuid": "8bc3f4c6-d3ec-48ad-bc29-1ba2a41a0609", "value": "4dd1356dc3f07fc377c121ec268f97ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933798, "uuid": "82dfa387-22c8-432d-bdfd-e40fc57572ea", "value": "98304:ANsBxdZY55/4TRiyflxrURTCwnEYklOIzU0lS5hkILpO6RGDJoX:AKW3FReaIzUF5+IL44dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933798, "uuid": "010c819f-1a83-4458-9435-e80dd3a167c5", "value": 13624832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933798, "uuid": "246e6512-e4f5-4825-baa5-bcf5a3015ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933798, "uuid": "b1926015-bff4-4198-9ded-1af626be1141", "value": "91e70b4f5f92e2f138aa8c612cfbc517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7870b643-3ee1-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776927353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927353, "uuid": "de4f04b9-b81f-4858-8a2d-d9019ee323b0", "comment": "Malware payload (NanoCore)", "value": "927010824cdca36282f8458d43fcfdf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927353, "uuid": "c49c3599-d4ab-481f-b6d5-b950633c0cf7", "comment": "Malware payload (NanoCore)", "value": "28f12b3e1eeeecf06b75b3f0d9c693f5c63937a65025b79e7e7096946d2f183d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927353, "uuid": "7df47277-d471-43b9-a5c0-93628c2811d6", "comment": "Malware payload (NanoCore)", "value": "468c28b01dae0fea9ad659f141a0aec14596a9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927353, "uuid": "8f7b5f94-242c-4ac3-8782-051bb492b928", "comment": "Malware payload (NanoCore)", "value": "927186fdb6aec7dec706486838ea9dc82abbb29216eded1171ec9afba12217d75d7ff784e7b0235c3ed9473e1f06b4c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927353, "uuid": "3f908181-f88c-4686-b8d1-628a828bc136", "value": "T16C14C05677A94A2FD2DE82B9612211439378C2E399C3F7EE28D464B74F263E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927353, "uuid": "dfc25eb9-1cf4-465e-9b41-7590a840c620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927353, "uuid": "99b8d3ca-2425-4691-8d4e-4f1d04bb790a", "value": "6144:sLV6Bta6dtJmakIM5iMBrwBJnaMC8xFev7y4QT1tW:sLV6BtpmkXMFIPHPe2DtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927353, "uuid": "2595507e-7d14-4e76-92b7-3ef5bf5dcdbd", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927353, "uuid": "4b94c6b1-1ca3-4b70-8170-48978263078d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927353, "uuid": "90dd6c59-3a7a-494f-a0d7-722fb3e59ae1", "value": "domain.it.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852ccbec-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776930810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930810, "uuid": "c897470f-8ca2-4961-b6ae-464bd7f861f1", "comment": "Malware payload", "value": "1f15e084f67b736742b2f399ff5d7dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930810, "uuid": "8e452c62-c6b3-44b3-9b8e-1b31741daf38", "comment": "Malware payload", "value": "294a44414b420785c5d07bc9ba2f8d182ab5682c0c43bcc3e6eb95667c5ff0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930810, "uuid": "59b876cd-d9dc-4ca4-acc1-f86f08e1748c", "comment": "Malware payload", "value": "5c51cf5b173d2f6144f33cb3acd7339279fbfdb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930810, "uuid": "bfff18ea-b6b1-4159-9816-be9a98cdd22a", "comment": "Malware payload", "value": "afd82961db976731ef5e32a2a7534ec456f473945b659ba3fc2588d50e5e86c540a0c4cdd9e91a838af3f38a78d9e191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930810, "uuid": "7059b6d2-6340-49a2-94e4-1f73c18066c4", "value": "T17DE58C0AF7D40994E96BEB34CB1B9732E275FC150671A38B1A15C78A1E73F914F2A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930810, "uuid": "3b1d0503-c9a0-4a37-bf11-6320fc4332d6", "value": "fd91c0cc57a80383b50aaf5d10ead663", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930810, "uuid": "8d06f0e0-87de-4a9a-9872-67f6a6ecc2c1", "value": "49152:hdHTN2DnO+UkH9O1y3W/IgQypegFS4Gr0WY1oIdEjcnGjRSy8Trig2N:zwrLwXZ6jcnGjRSy8Trig2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930810, "uuid": "9bc4a011-470a-4e64-85dd-38d36c4ba7e0", "value": 3238912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930810, "uuid": "e9921926-d57c-41aa-a75f-38d5afc17861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930810, "uuid": "ff6acd01-f2bb-4ecb-9070-9c741b1042b9", "value": "msedge_elf_5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8301cd-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928009, "uuid": "d6c56c8a-f50e-4fec-ae9d-ef27baf196f8", "comment": "Malware payload", "value": "fa65a1651954029f28ce380937ac09f7", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928009, "uuid": "e0f48fd9-da93-4d8b-8aca-5198d6ad0f4a", "comment": "Malware payload", "value": "29cb5187cb729fc217402711bc0055a5e117524e251a4da080e3c5e472746f24", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928009, "uuid": "e84662f3-aff4-47e9-bfbc-0becf50727a3", "comment": "Malware payload", "value": "c509e2af443bd5c0a1f3e24c335497b94c42c6e4", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928009, "uuid": "95016962-fb4a-4386-b0dd-e5e4753f7a70", "comment": "Malware payload", "value": "681e5d25ad766a857081b828d9dcaca1154f61f0bcc7bfc3dfbccec33639d40825332cf84e6714dc3704f5f9912ed907", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928009, "uuid": "8e4cad49-19fd-4993-aac9-cf6f6a0a8d98", "value": "T1612723400D99C9FDCA28022D297E46FF49E1CB98DE859ED457EAEC1F8826746750F32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928009, "uuid": "8823a93e-4d1f-4723-bc64-a96bbfe7b399", "value": "49152:47XmlveU7Xmlvem7Xmlvey7Xmlve47XmlveX7XmlveZ7Xmlvew7XmlveO7XmlveV:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928009, "uuid": "03e696d1-017a-47d4-b5fa-e6d7b1e43da6", "value": 21611511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928009, "uuid": "48d04f13-9341-4ad7-97d2-be9d1defd085", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928009, "uuid": "52db20fa-89f7-4500-8e08-697df986b8b4", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf94ba35-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924493, "uuid": "9458d651-7592-4327-bbfa-5066b11a1d65", "comment": "Malware payload (Mirai)", "value": "75b70444b679bb93f316181b3971714b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924493, "uuid": "eb9ad41f-91b0-4047-8b1a-5b8aede7ddd8", "comment": "Malware payload (Mirai)", "value": "2a06ab5f85c8f7e5ceafcdbee909bb0898a97d83077b7a89df7fa7d8e2d3ff4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924493, "uuid": "7c6bc798-51a6-4187-9c5a-3457b3118a3a", "comment": "Malware payload (Mirai)", "value": "f1967cc9807144444e805c1592def524af3292a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924493, "uuid": "d01e4966-4eab-4a50-891a-4853646dd639", "comment": "Malware payload (Mirai)", "value": "e921e4a7f1e1962b5823a5feffe22956956b124e7f364c118d4bfaf37e273dab2a8817251943f51d59d9334c8b6c7335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924493, "uuid": "98875006-9917-41aa-b18b-b2fbe600e028", "value": "T1F925095B2E328F5DF270CA358AF30964DAA833D717E18585D1ECE5241E20A4F951FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924493, "uuid": "e0455980-62cb-419b-a8db-64f4a5ad5106", "value": "12288:Sd9D+W/tMvhEpgqZIpadLkVpeeZ4QDh0ne8F4ByfHNdvGBm9xdoh6I0m8EJIPy1R:SdzPl1ezmcI94mTd9TicSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924493, "uuid": "4e8ef761-d9dc-4773-8d9d-b193a2cb0442", "value": 1005912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924493, "uuid": "dc518544-3e71-4b7a-b6ef-a6e8ed252cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924493, "uuid": "03c32c5b-0f58-4615-9515-19ec599fb081", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea446ec-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976192, "uuid": "3cfe76a8-346b-4f39-a3ed-2a72830f7778", "comment": "Malware payload (Mirai)", "value": "5deaf04e391f5687674da38e424a99a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976192, "uuid": "7a5a7f30-75eb-4096-ba4e-8de622cf063e", "comment": "Malware payload (Mirai)", "value": "2a3fc6c5bf91df62bd406e9f6d082010283c564ac281a464757bf983bbf2e6f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976192, "uuid": "2411a170-9bd5-488b-a98a-9e9c0088f6b7", "comment": "Malware payload (Mirai)", "value": "148cf0b4d624360efcf6a1730cbee785a153b6eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976192, "uuid": "563d354c-baa6-4b62-9143-195c4a5637c6", "comment": "Malware payload (Mirai)", "value": "9394ffcac524071d0bda8a7161f59dd0cd285b88c00c291b5694f273e3a52c2840b044147ea439d35133653eb2a62d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976192, "uuid": "bf1d44a0-1e16-4076-ba21-441ebe081c66", "value": "T112B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976192, "uuid": "245bc02d-4f1b-43b1-ad5d-c6579dab064c", "value": "1536:Rg4uLcytbI96ffY2aye7tcOiyRLqlqOgb3a10S/LWmoo:e4uLcytU96HY2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976192, "uuid": "5dc2146a-7d3b-4d31-84e8-95785d102455", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976192, "uuid": "83de6a59-ecb3-450b-95d0-6429ffa64842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976192, "uuid": "a76feee5-acef-4620-acf5-cb3436238edf", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b907e765-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924455, "uuid": "dd6440d9-ff58-46bd-a981-d48b4c581864", "comment": "Malware payload", "value": "368e857e1f7381c1b766ee2c0d4f8717", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924455, "uuid": "ef482915-b0ef-44a7-87e7-e75fb2b8cc89", "comment": "Malware payload", "value": "2aa961d3632b87b1f2fb2c9bac205a9ef28f7af6360e983ada92fa93c8aec08b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924455, "uuid": "ae80ed11-337e-4314-a7b3-fff09e8f0f32", "comment": "Malware payload", "value": "a58d8e6d8621ec4f33d4e8633373d2719a723bd9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924455, "uuid": "76d1ce0d-3536-496f-af16-50441ccd0348", "comment": "Malware payload", "value": "9826bbf57ea8a8b563ac95bf57a4d466eee8369160f1f46ebc927115d06f001ee2e5a984a337254b97e0eee6b419ac2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924455, "uuid": "00758e56-a63c-47cb-9e11-6db0551a7183", "value": "T12531990A7803CD8F03A693AB392700D994C8CC859E8D45D2F110FCA478DE99D8287B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924455, "uuid": "10d42b4e-2c1e-439c-b80d-bab024e6ec69", "value": "24:4qhsB1dKL9yqlyqk6Qi35lOMIl2u4f9TRQVDzRtWLfy021PFVdEDdS72:WrsMqQqk6NlOJl2L91QVptQyVdEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924455, "uuid": "88ececcb-c55c-4bc1-91d0-8619159de18f", "value": 1825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924455, "uuid": "d86b252a-3487-4efb-916d-b044269c8fd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924455, "uuid": "546a710b-6b50-4a08-8b3e-d1d8fae9efc3", "value": "2aa961d3632b87b1f2fb2c9bac205a9ef28f7af6360e983ada92fa93c8aec08b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966f5d9e-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776912371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912371, "uuid": "9a56971e-1b31-4e9e-96c7-cfb25bd47b43", "comment": "Malware payload (MassLogger)", "value": "13543fe2894ca8577f234c4641ae4890", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912371, "uuid": "d66a5703-b8f7-49b2-8773-08351d443dff", "comment": "Malware payload (MassLogger)", "value": "2b9067eeb7909d5e78c83d9a37b379d6531a5b893d5a002b06c4f851edb1f402", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912371, "uuid": "e1d7f16c-c86b-4cf8-be0e-9b9dcf346acc", "comment": "Malware payload (MassLogger)", "value": "22d48c4483602f87e5d94764dc838cb403de31c0", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912371, "uuid": "66a1a972-8537-4138-9f9d-a9f56ea62dd9", "comment": "Malware payload (MassLogger)", "value": "a3715676e352a411f342bd1ee2d7ba03e712d6db472af6121a873c7c8a42021290351526d9f9581dbabc714068e76dc6", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912371, "uuid": "6b93df6e-0611-4417-ab76-957689966cf8", "value": "T1DDB302020F676965AD66CB4C372BF78CABA26913C06300BF9BF1945B269B50361DCD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912371, "uuid": "7fe2ed4e-a987-46f6-bd89-9df2c8940ef0", "value": "3072:qZZbM8Z6O4fpasfttcUr3pTr9PdqVD6jcT9iC:ubML9fwosL56ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912371, "uuid": "d5300adf-f841-4887-bedb-cd5fd45e269b", "value": 108644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912371, "uuid": "08cc209a-9327-4a6d-9e94-0492252bf022", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912371, "uuid": "7b89b58f-3801-42e3-8fb6-0369f5c9a315", "value": "Gold.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e16b75-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985596, "uuid": "8bec65b7-49d0-4296-8b6b-fe172b80392a", "comment": "Malware payload", "value": "300bcf201ea3d101d0e83eac91ae3fa7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985596, "uuid": "fbbdee3a-8106-4491-b954-363d81a06895", "comment": "Malware payload", "value": "2c7d444c6f15bf93fe0e6476d89b39f704bfcc848a7727e4c10024fb4bfcff0c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985596, "uuid": "77d6d910-b3f9-4dfd-a834-d7b7285f095d", "comment": "Malware payload", "value": "a4e168207c8c23c6606379b244286f224328158c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985596, "uuid": "5d6b3d27-a24f-4868-a853-59025f34c92e", "comment": "Malware payload", "value": "3f55c20d4b70323300f285b7eda50be7980c46e247c554a2e7657a2cdfc4c8dc5406bed9a24ba53624626545613b2129", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985596, "uuid": "258f2d2c-98da-4d8d-b1f9-08a302c8d18c", "value": "T1C9C312CA5E414EED732BA29C35D7395ED1ADBA08D0D68A1034C07BE7DC6C94610EBE07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985596, "uuid": "684bf343-bf64-45fa-87aa-748560b31b42", "value": "3072:QQjzsEnnARv0eCvW7D1BX6hH1ShFlRqJGV:QQnswS97DzXaVQlR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985596, "uuid": "6f20edc4-a3d3-45d6-b766-49b61b97959a", "value": 122216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985596, "uuid": "697c47b0-b545-4773-bb59-508b5328e958", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985596, "uuid": "d4467d0f-c1f8-47d9-82c3-c93116cb0049", "value": "mystery.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1509b93-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924469, "uuid": "fad462c4-9cca-4cda-affb-7692445a24c0", "comment": "Malware payload (Mirai)", "value": "df87b1ad2d0849f5234a0175d2d1f263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924469, "uuid": "e37ab844-f9bd-419e-9d4b-193ef7e2949a", "comment": "Malware payload (Mirai)", "value": "2cc3728ebc8fe1c12ccd199a39ac68748fe524290a4806b3ecca59b40760c6c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924469, "uuid": "6021a6b9-d1ea-4e76-b955-e7a34b70379a", "comment": "Malware payload (Mirai)", "value": "6d476da6f3d2f45104acae83350aa2fa20e91eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924469, "uuid": "62a43942-c433-4890-8585-9c6473bc3975", "comment": "Malware payload (Mirai)", "value": "3d5a86cc2cf03cddd06b4852081c803d30bfc832d625ea73d313c53a9ddb00b36091e7a2c5ddb60e6b436f7386095074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924469, "uuid": "5cdcb592-bb51-4045-87df-6115574f2d7b", "value": "T187F43925BD019796C6D06ABBFFAE838C7313177CD2EF7103D90547253AEA85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924469, "uuid": "aed18772-3b10-4634-9c2d-fedec62365f8", "value": "12288:V+1RBTzI7CDHvE/NY/mPpBqS6MGxS8MyXZf3wokwDDFlhDqBTwI1X94Qs/n8u0ni:MPSP1gkNnljiLoDSWbTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924469, "uuid": "38ef2685-e8ce-43fd-80b1-5e808f9cd4e8", "value": 773688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924469, "uuid": "61f8bedd-eb7c-4956-83ed-9cb00e7b113c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924469, "uuid": "6262b365-4471-4b28-b71d-8c27c723ab63", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6687d0ec-3efc-11f1-a769-42010a9c0008", "comment": "Malware payload (GoGra)", "timestamp": 1776938919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938919, "uuid": "fcf075a2-5b37-46e1-9500-8cef5048385c", "comment": "Malware payload (GoGra)", "value": "8f1af2175403195726957dc58fe64821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938919, "uuid": "1d695b38-92f3-4ae6-91fc-ab8f9781a5d3", "comment": "Malware payload (GoGra)", "value": "2d0177a00bed31f72b48965bee34cec04cb5be8eeea66ae0bb144f77e4d439b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938919, "uuid": "6b1d9c10-e1bd-4846-ac91-a84f46056683", "comment": "Malware payload (GoGra)", "value": "c78c6f9b78e9503ab1a079010cf12a6182ec4d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938919, "uuid": "0350d1c7-ad72-4fb0-832d-f866a62b01d9", "comment": "Malware payload (GoGra)", "value": "0866465b9367911acef019abd2024ce0b52eb330e09dac5457390e3b16d49bf7965597690acf8e9268160f91ca47ec1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938919, "uuid": "6bc724d0-cb66-46c2-8968-708f1be11623", "value": "T100764902FDCB54F6E4071A3105ABA26F67316C054F25DBE7EA407B29FA7BAD11936308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938919, "uuid": "3dc02e39-a44d-439c-a0fd-9a424993e286", "value": "98304:ETc+Yfpj741MC2X86dZnIeAsTi9U2luEXsa:ETaRSoLn91Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938919, "uuid": "3cae6c9f-c698-41a4-b916-039f576b347f", "value": 7799076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938919, "uuid": "1c07b454-4cb9-4737-98b9-253f0590f8a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938919, "uuid": "beca5285-edbb-4a87-b74b-ebbc84812e56", "value": "2d0177a00bed31f72b48965bee34cec04cb5be8eeea66ae0bb144f77e4d439b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aee58f5-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1776956456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956456, "uuid": "7d59bf0e-563e-4790-b9d3-8d7f663d344e", "comment": "Malware payload (Worm.Ramnit)", "value": "d20ad1015759a1f674fef51dce1cc5a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956456, "uuid": "daec0156-7c08-4525-b1a7-da2d92674e68", "comment": "Malware payload (Worm.Ramnit)", "value": "2d486a66b292601bf7545b3ddef070ced7a7fa89d843dc3c464035fbaf676750", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956456, "uuid": "866778c4-6016-4ae2-9a12-2bea78397648", "comment": "Malware payload (Worm.Ramnit)", "value": "f06487193f854ceced031f6ac41a80fa15adfb64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956456, "uuid": "9d347bf7-f3fd-498f-ad40-497105f60878", "comment": "Malware payload (Worm.Ramnit)", "value": "1a29410f0df734885b028f1dbb1dcb1148a3be38b2342fa246c826cdf8ffbafb43b7d1f0c2c4c8a92af1e5cda28135a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956456, "uuid": "308e6169-ecb5-4ac5-a28a-784f0cdb44b8", "value": "T17A05476125B2C234E9FDB3B04FA697E958E6435C0F2987F216CE491A1A3774BCE11D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956456, "uuid": "9eb07c69-c709-4296-9141-93b6e4a0d388", "value": "49ead5d6f5bdbe7ee2122e2b9c28c45f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956456, "uuid": "03e18bab-78d9-4cbd-b5bd-4f312a2fd3eb", "value": "12288:67hNYT3BpI7Rbe5NemWXLSneAjxWef693wsv+VuTwboqevDk/:67hNYVO7Rbeom2LSne4Lf6HT6o90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956456, "uuid": "b02c6236-51ca-45c8-8476-d2f232156629", "value": 873389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956456, "uuid": "bbc11e34-da12-4bef-9579-e6bc9dcd954f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956456, "uuid": "0547bc53-7478-40fb-b837-e0356139db12", "value": "2d486a66b292601bf7545b3ddef070ced7a7fa89d843dc3c464035fbaf676750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698169a5-3eb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776907142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907142, "uuid": "879bcb90-a0d8-4176-8ac2-91dffb1a2677", "comment": "Malware payload", "value": "bfa094cf4a3cd3d5d6e2f64e2c28f2c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907142, "uuid": "9e01906f-07e6-4b70-baeb-ceae6bd6b83a", "comment": "Malware payload", "value": "2d79d41c3054d58aef97fef83e0bd11a002b71bf57e2899abff49a454fd392d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907142, "uuid": "4075a670-b13d-469f-a30d-27e574158c6f", "comment": "Malware payload", "value": "e7b992067118070090bccca9c021f9f4f70187ab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907142, "uuid": "b82123ee-31f3-4cde-873f-baaf3ba130dc", "comment": "Malware payload", "value": "ef1bb3b8694b0543e4d3f3dce3a8e51dff25c26f1c9eae890b92d9400922ca1864191675d29670840c1bf042bcac2af7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907142, "uuid": "b0c78442-f895-413c-933b-c886cb4f1302", "value": "T188065B31724AC52FE96201B1192C9A9F512CBF360BB254CBB7DC2E6E0BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907142, "uuid": "dc6636bb-05f9-4f7e-8dd9-1504330faad0", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907142, "uuid": "045c7a37-e948-42e7-bffa-a21e9241a6bb", "value": "49152:+WbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l53HPAELcpB2MpF8G0:+r99u4kc8Hao8eRjYBU4UAir2Y5nHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776907142, "uuid": "9bf733e7-2440-423a-93a1-505d7c5c8bb8", "value": 3682134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776907142, "uuid": "7a290396-a28b-4acf-93e4-bcb72b161b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907142, "uuid": "e382631a-ad5c-46ac-a7a2-c94c1a06cb7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7829202e-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935083, "uuid": "0850b54a-0d5b-473d-b704-bb7a8fff9c1f", "comment": "Malware payload", "value": "44d252dfa884371de5eb25c03d0c216a", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935083, "uuid": "af30ade1-9629-403a-9a1b-38832e013881", "comment": "Malware payload", "value": "2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935083, "uuid": "e447040b-7ddb-4162-8eef-2311d56fc758", "comment": "Malware payload", "value": "80dfa6db38a51bcd55c5123ceb3b444fc6dddf4f", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935083, "uuid": "72fa386d-63bb-4a7e-8ab8-8ab2cc7adc3a", "comment": "Malware payload", "value": "b71a5f4fe72ce76d22e5b71ad1feab44080e0bb89e54daee4fdbc485c83699dbdce7dea871febdd7a5953178639b0ef1", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935083, "uuid": "0cf2130d-4a22-4ccb-a7f9-a6ecb05c7101", "value": "T1F4C46D347E422EFF5FB820D248D5811C563C22B5C9686DF27ACB1CA2290D77627B79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935083, "uuid": "1b71dd68-f56d-41ef-bf03-3c1b293a6a72", "value": "6144:P1W0ieykSSQblq6E1k0T/ty78OrRicKZnEtfs1d3JEq/RGEjEgCi074qpB6d:PM0ierSVl1E20roKZiIJRs4qWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935083, "uuid": "c59fa6c5-034f-4c55-a909-ac8f0ac25024", "value": 583978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935083, "uuid": "9e5ae526-5640-408c-956c-562024ed87e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935083, "uuid": "6e177e81-9cba-4587-8a19-68ce8c64b53c", "value": "2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5a48dd-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934309, "uuid": "af6cefac-49d5-4d2c-a8c5-b1c765e65cc7", "comment": "Malware payload", "value": "1dcd3df471f2d5cc8626f2b5749aeb4c", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934309, "uuid": "162f66f2-7c23-4f83-bb4e-90e2bf2c6055", "comment": "Malware payload", "value": "2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934309, "uuid": "f3d89d26-0b01-4866-9c74-4621b8bd179a", "comment": "Malware payload", "value": "e5beebbf996dd9984c2580bb80e2ee194ebbd57a", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934309, "uuid": "a451a210-e3c9-4693-83c7-151af40e3883", "comment": "Malware payload", "value": "1abd950a83815b69b191ebd1a3bd23e0c134fd1b05c75e7712804f166f47d7428b8ecde1e5e683c67124816ffd67c0f2", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934309, "uuid": "b5e84870-0a41-48c1-91bc-f1f54def51cd", "value": "T188424D60AA6A1CBF877461C081CA462CA9393374DE341DD96DC36CF2181D77E2B669FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934309, "uuid": "517bdcb5-82bd-4e06-a428-4849e5f70cec", "value": "384:MAhvOq6g2FrU/088hibSxi6N0ziIze53+s6kjM:dmY088hiqLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934309, "uuid": "0fa8f7d3-a6be-413b-b68d-57ff13be99c8", "value": 12573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934309, "uuid": "06c86808-19af-4d97-ae03-81ce5421aee3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934309, "uuid": "7c8dfdea-0e6f-460b-a18d-f0cfeb4157e3", "value": "2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f715f9-3eb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776907572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907572, "uuid": "760fca29-e3a3-4ad9-aa4c-ddcac6da1ea7", "comment": "Malware payload", "value": "66959085d808e04b78b3ca5b5f4da55b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907572, "uuid": "70826860-3427-41ae-8c34-970cc2925edc", "comment": "Malware payload", "value": "2dedab8ce45272a9a377b64343f31e32e7eba4b28fc120c1149863dbba904ad5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907572, "uuid": "4c72741f-3be9-4d18-b25c-347c0e7d7167", "comment": "Malware payload", "value": "086e42c286948a50a994c7098fb988b47a96bb07", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907572, "uuid": "2031bb88-c015-45aa-baf3-aad71e1169ae", "comment": "Malware payload", "value": "7b2b18f380f690acd135ab400eda61e00b19c65f9aa28b4f8f18593113e08c67e3ad1b7bf9b9170eccc9d300bc88209d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907572, "uuid": "70699348-60e8-474f-979a-68842e14de9e", "value": "T19C5133450FC051EC04E34293E0EDC71063F983F7992D5C64E6B8EA7A99B02CD427F8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907572, "uuid": "e2b1fb1e-f84d-4756-a881-9df4beeb636c", "value": "48:Bwtqrj4Zhua3PhIhOHGp8RZkdiPnPcKw7gUYtVD10nD9WR35ZFLRFBRxDCJ4V815:eqrj/aDmp8R2ho0DAvLd7u12B2SFYzbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776907572, "uuid": "5eab7e06-f52e-4b06-b9df-691e47afc5ce", "value": 2971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776907572, "uuid": "d62edbb8-a260-49e4-b099-4bd8b7e9f936", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907572, "uuid": "59d874df-5f11-481d-adad-9fd714767aed", "value": "updater.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d61e62-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776927906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927906, "uuid": "fc912d61-3fcc-41b3-afb0-155028d8b6b3", "comment": "Malware payload (Phorpiex)", "value": "5a79699bb5c1d9816cc7297744fdfa28", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927906, "uuid": "1165045e-4045-48a8-aa1b-f1021bdf2005", "comment": "Malware payload (Phorpiex)", "value": "2e5438fd421162abf69c23c9c8aa01426d2f27b2516564bc9f8e7d56c64bac24", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927906, "uuid": "4808cb9c-9a6c-4c30-9d5c-9ce385335a09", "comment": "Malware payload (Phorpiex)", "value": "135b5778490e4c12bf5750bf4309cf6984a59c1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927906, "uuid": "6f49f4bb-88cf-418f-b330-4a0a619154d9", "comment": "Malware payload (Phorpiex)", "value": "3ff1ec576f7d5d6a1093ff3c4785cfc63bdc748cbbf34708a2a7fe9b46bdf75f6a4c67a46b27a422c2deda8a194f0a97", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927906, "uuid": "7ef17a11-2fef-445e-9176-7eaa055fd6b0", "value": "T160824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927906, "uuid": "6682e2da-03b3-457f-b282-30f789b104f9", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927906, "uuid": "c362dcac-134b-4332-a037-19950c70eff0", "value": "384:gI78VGQic1Kwzw077u9NHu/gBhav8U9cV:xAo0769Zha0UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927906, "uuid": "8501a8cd-9017-465d-a6f2-d8587e95cc48", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927906, "uuid": "6d891de3-b482-4f12-a300-e1720b1a4f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927906, "uuid": "863b3ee9-5e76-452c-8a08-914f24a16b1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59909ce6-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776926442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926442, "uuid": "5bffea1b-3897-428b-b386-df5e3194191e", "comment": "Malware payload (NanoCore)", "value": "b730c0eb38db4a5a8a653296a4973651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926442, "uuid": "f8e251ed-70bd-45a7-a286-621e66980cc0", "comment": "Malware payload (NanoCore)", "value": "2e6ccc6dd16b56e28b7a9f4e020e974fe5bb61d3f8a3d6df5bf12b901ccf5d9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926442, "uuid": "32774184-202b-4e68-8fbb-5ebd5d857220", "comment": "Malware payload (NanoCore)", "value": "4758920267c08fca6425f1e78eeaaa56ebbbb702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926442, "uuid": "3ff9c2a0-454b-4228-9f37-640423d9ae0f", "comment": "Malware payload (NanoCore)", "value": "3f2774259d8d8d7fff9ab300278365ec61720b728716b2c5c32966afc8b9abcdc7595df05769c0cd4f47bb92ef87d79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926442, "uuid": "cf63f85d-ee08-4c75-8c6f-5656e2b55bbf", "value": "T186656A3C28BD3627C030E6B58FE8C463F154993B3E219D2766C29799471AE5225C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926442, "uuid": "f9c0631a-1cea-4675-8288-bcdcee6deb6b", "value": "be63889866f6bba2109402ee273e5652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926442, "uuid": "ad01ce1b-b9cb-43e8-80a4-44066048ce11", "value": "24576:HJVTz0IgMkh6yMno7jEfeCppjsZRn0dcxgk2GVkCvbX3D55:fT1gxh6yR76pnsZRn0ezpVkEzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926442, "uuid": "334f121f-1f48-4842-bfa6-35a8c2f6401e", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926442, "uuid": "f5c188cd-ed00-4823-a171-ebca068972c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926442, "uuid": "9e1ce357-fcca-4823-bb44-50a327e1fe44", "value": "Sorter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af20b88-3f24-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimwolf)", "timestamp": 1776955972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955972, "uuid": "203458a7-06e8-4d9c-99cb-2bb901deeb51", "comment": "Malware payload (Kimwolf)", "value": "33faca1e0090f6b12eff703daf4606e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955972, "uuid": "fbf3f95a-e845-47c2-ae19-5bb9e99459b2", "comment": "Malware payload (Kimwolf)", "value": "2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955972, "uuid": "c25cb2fe-992d-49ee-b483-ac94a82d70e5", "comment": "Malware payload (Kimwolf)", "value": "2675949d9d204dc3bb8848037df319df119aa140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955972, "uuid": "c8b23f34-67ed-41f0-9922-0ee7127e316b", "comment": "Malware payload (Kimwolf)", "value": "c929abbcec8f511335fea54320c13aa6393751a8acdf6ed6232e70e7ebd477fac3d1cb601587aae09885caba4cc573fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955972, "uuid": "5f06405f-1e34-4235-a60c-852f6fae0569", "value": "T10485E18BF6160869C6AF5235FA430DC42C149C5EBFF2EBE862C585BD747E310DB16262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955972, "uuid": "8a76b917-571c-412f-8832-0e99be32b7cd", "value": "24576:vqhzqCZIFM71hGvfjUwFe5Or7s0TCpiIjYEzVtUEOYBU0Bmkbe2:R7C1hg7C5cu1YEL4Iux2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955972, "uuid": "61dfbf12-6676-4008-ae6e-223e343d3c7b", "value": 1721424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955972, "uuid": "5bd5c2e1-b32b-4da9-b6de-c6b6df1da815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955972, "uuid": "7df85d66-2673-4618-8fd1-462b841024ad", "value": "5a9189bf7f420d5b6405e534d043e5485c733a8b4a6d21b4c7b9d3a6cd2532ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce83122-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776931199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "b7830ec2-a3f1-4784-87cd-62a1c64f8072", "comment": "Malware payload (RustyStealer)", "value": "37ff340d08d783c7b216db2cffef46ce", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "83d6ab37-6863-4c2a-9830-bf73ebdab651", "comment": "Malware payload (RustyStealer)", "value": "2ee5c9a87373c41e82e2028292851c04e3b799a1094bf9e37673366bd79fab41", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "37b0868f-a5e9-4e90-afa1-f08bddfb4d29", "comment": "Malware payload (RustyStealer)", "value": "7224bb558b0c01a2aacecdb4a0ebe6095f5550e2", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "ca8c8b40-83e6-423f-bcf3-a4cc7493e931", "comment": "Malware payload (RustyStealer)", "value": "db178d4e0a2fddd9185512859752eca40059ac66262bc37739f8ab18d9ef7e7e4fdefee783d9d1db4d40a6127b6d6524", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "c364ab5f-cb2b-47b7-91f0-0c285502aed9", "value": "T13D063343FA91E3B2E46949F0147A73745A7EA9150F22DCCB53C0285C8FB9AD0CAF5939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "22259222-716f-4e12-b9a4-4331ca1510c7", "value": "f087bfbb92458fe3322914962d334522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "7a2389cc-2c9f-4d10-9dba-ea41a0287a67", "value": "98304:q33g0hxzlLmGurpeTpH8zHw3cBHdJiNbgUp:qHgORA7peVH6rHMNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931199, "uuid": "4b945972-d81e-4e66-82fd-d46f316f0d72", "value": 3783168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931199, "uuid": "616d0b6d-d36c-4066-b502-e606c7699710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "b7bedcf4-3a58-4298-94c8-9e5da8a35281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90740321-3ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776922669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922669, "uuid": "09ff75cd-549e-4d19-8362-1795bdbbdb8a", "comment": "Malware payload", "value": "7d613de116b24c912f731e46ba192756", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922669, "uuid": "ce5d393e-ffea-4927-a395-cf38ce663543", "comment": "Malware payload", "value": "2efdfb034e34939042ca58740febbe0b7fad6b3543391465ddcf24c792fddfb6", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922669, "uuid": "437e3497-0e0a-4f1a-ae20-93ec40db7bf5", "comment": "Malware payload", "value": "d71d118ca682fab9eb1e9469c619cf774ba5d39e", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922669, "uuid": "bad5f5f1-1fbe-4866-9823-65ac046916f7", "comment": "Malware payload", "value": "d3e2e0d93b8ffaabd7e88b17edc2ed9f21df2bfc4cf149f7fcf27175194e6261d246a7ca9fd2da2583151edcbb3e1cfd", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922669, "uuid": "8c94a212-08ab-4daf-9558-303dadc09f0c", "value": "T1022712024DBCB62A25F14338749E786F6FB50DD4042EC66DC79B695B001FDB270A9CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922669, "uuid": "51a74c49-bd20-41fc-82d6-8c2554aad263", "value": "49152:zfuMb9H7IG5+eHSkNn8JiHSL7HbCQ3HZCO0i5AHS4HS79juHSIR5xC1+nNLvcQ0t:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776922669, "uuid": "d15dfbd0-cae1-4c4e-8f75-6ea424c1ffe6", "value": 22331553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776922669, "uuid": "3829c2de-8c10-410e-b48a-24b43b6b502f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922669, "uuid": "2f26f565-5a64-4919-b741-b5bda3fafae9", "value": "invoice-1645080830.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32add7bf-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944845, "uuid": "053fe11d-9fa1-4921-bb42-4641ced2d121", "comment": "Malware payload", "value": "7a98b7f6c9d85e528c57f2e31bf85147", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944845, "uuid": "77cd89b3-ae56-4f18-9deb-c7f2d3f26e39", "comment": "Malware payload", "value": "2f57ed5ac601eca90491d96e3fa991499a84a7dcb93f10c564790678a3d0a675", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944845, "uuid": "82ea608a-3274-41ea-8ecf-909747b43f8d", "comment": "Malware payload", "value": "6eca4e8f7cd2697e1e70a2e72401da1b1a785bf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944845, "uuid": "51623d86-b4e0-4cbf-8aa5-93db278a2f60", "comment": "Malware payload", "value": "d699538489ce9e1db882e92d53806af96444ac45af85d71541b6c1faf87a95ed31e23e735652e995a170dde35144739a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944845, "uuid": "8c8f00f6-b105-4850-b3c4-a4d30a0fef49", "value": "T1C771321AD7E8466BE07A0734AEF34717A7B0F8948B73432E19C01225AC627B81975BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944845, "uuid": "8ab90ae6-8b9a-4ded-a8fe-11a013be3ae8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944845, "uuid": "7c66be3b-f9a7-45f1-b6c2-fe7873894b21", "value": "24:etGSI9pzxMjgnNSXMrw/tkZfrO5mo/FD1WI+ycuZhN0akSwPNnq:68hNSCJS5mwA1ul0a3oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944845, "uuid": "20d1d1c3-9136-4d93-938d-b188b2abc982", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944845, "uuid": "7df9bcb4-6a15-4d6c-957e-707a10867c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944845, "uuid": "a485c527-c61c-46b3-83e6-3055f462aa89", "value": "y2ovjgfe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a36ee6-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956559, "uuid": "64f019dc-f906-45b2-bac8-89c9937ab45c", "comment": "Malware payload", "value": "cf0d1817051b09ecae910069ba5cd089", "object_relation": "md5", "Tag": [ { "name": "204-12-236-177", "colour": "#A914AF", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956559, "uuid": "c2e1a549-771a-4884-9b3c-f412b31781ae", "comment": "Malware payload", "value": "2f7f476ea5513d20963ba9834765f9712823ab720b42f101c844e0c148728c3f", "object_relation": "sha256", "Tag": [ { "name": "204-12-236-177", "colour": "#A914AF", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956559, "uuid": "895cef17-b6b6-42ec-b88d-21db2fb0d517", "comment": "Malware payload", "value": "daec470a9398aea304ed64f01a9b8fb583bcf16b", "object_relation": "sha1", "Tag": [ { "name": "204-12-236-177", "colour": "#A914AF", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956559, "uuid": "cf11ff3c-694e-45af-a4fb-2a0220636084", "comment": "Malware payload", "value": "58d9f3a208152e87dbd20aefcc0ef17d87cc4cf816ed2e5f7ee22c4906be1deba372412792382f7ec8e9dac35c914c2b", "object_relation": "sha3-384", "Tag": [ { "name": "204-12-236-177", "colour": "#A914AF", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956559, "uuid": "cf5606d4-3719-475c-a61f-a92fc9ea8c9e", "value": "T12C279EC2542C4651E71E1EDF4BD46AB3F86C80361BE51A8BFF0E950536921C8D6A8BFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956559, "uuid": "2fa54586-d05c-4af0-affa-07703e9fb60e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956559, "uuid": "7b49f8cd-c98e-4310-9799-850cf34ac17e", "value": "6144:oFLCCkCCgwCCgwCCg1CCkCCgwCCgwCCgkwCCkCCgwCCgwCCgk3CCkCCgwCCgwCCp:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956559, "uuid": "69de334f-fa45-4b47-8ad4-ad97552bf066", "value": 21662208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956559, "uuid": "ccedbdf9-0d76-4c4a-a70c-268660e4449c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956559, "uuid": "e2076c2c-bac2-4ca2-8d70-5d14e443aaec", "value": "2f7f476ea5513d20963ba9834765f9712823ab720b42f101c844e0c148728c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3389128-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924445, "uuid": "247c0c3d-3413-4213-b205-ebaddc5f64b7", "comment": "Malware payload (Mirai)", "value": "521babc4f7677fd52f2e50c51d7bf983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924445, "uuid": "c52b3ea5-1146-4c6d-ba22-2706a6c737cf", "comment": "Malware payload (Mirai)", "value": "2f81b22bfa926844d3cca95998cc3fbd14665e1997b205c7ed29dfceb43438a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924445, "uuid": "2749eabd-a454-4565-8543-810edcded25d", "comment": "Malware payload (Mirai)", "value": "54da527f673c136a4bdf8bf05b71520d7a921b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924445, "uuid": "09f016c3-2f02-4cbd-a5d2-a990b5c78abd", "comment": "Malware payload (Mirai)", "value": "dc0ff23dc4022ebee81cedd4f943ab0f9ceb3b145a8c6b762c3ed6f428a273e9f13050ac47ddb4343f89b56595b12332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924445, "uuid": "1739f6c5-b43e-4c0a-b487-84e33e388e7f", "value": "T1D9933A95BC819613CAC513B7FB1E028D372623F8D2EE32079E215F6173CA96B0E67552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924445, "uuid": "f6597c75-c96d-468c-9a39-f5f93ab7587f", "value": "1536:7GxjzZ7ML/nt2UAHexEmWJdh6w/CvYfD4dGGfRK6kEYlNEsaPPmQsu:7GxPlMLUiZY0tRK9lNz+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924445, "uuid": "5e0ce35f-2bc1-46ef-8434-18fabae84bcc", "value": 91872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924445, "uuid": "d7897e38-66f7-4902-a804-1da6e4a41fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924445, "uuid": "e37db238-0f8c-4fe6-9f71-5d774be89d49", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33e6b6b-3eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776909386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909386, "uuid": "bd1b8893-8593-44fd-a3cc-06e47d24942b", "comment": "Malware payload (PhantomStealer)", "value": "571ac90edd084156a161da95bb8a0b24", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909386, "uuid": "ed21f06f-ef73-4ac7-8a32-763528687bcd", "comment": "Malware payload (PhantomStealer)", "value": "31586b671da3dcc7ffe05d33b4b64880a6f37cf24c238f3bd3f7664363d7d473", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909386, "uuid": "9527d8c7-53d2-4a55-a538-efcc48e0cfa0", "comment": "Malware payload (PhantomStealer)", "value": "c03af58cc0875554ec366d15f3c8c38a6eecbd6a", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909386, "uuid": "41a0dd1b-8b12-45b8-bfcd-9473c7d0c062", "comment": "Malware payload (PhantomStealer)", "value": "2d70a862fb016449a8ec54d6df45ae49b1c28c8733366f89d523ee421d0f5b1e54b1ff3235b2db45c0b097e8bca1c05b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909386, "uuid": "90b78b37-6f48-4c07-987d-3d4d00386948", "value": "T1E12523315F227DEC0564D12C303F3EAE5E555A9190DF56F74BEAE88B1EACA01219F0A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909386, "uuid": "74ac057f-b101-4b81-aa0b-79ff282092b8", "value": "24576:ek8rDVcrQY+Qz+qXKJlRWQltUk8QmM1h9vM33I:5NiXt18Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776909386, "uuid": "fd182d64-49f7-4672-9c35-4d40cad402fe", "value": 1048357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776909386, "uuid": "279e3f54-6244-4722-b7d9-4487b995f2bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909386, "uuid": "3cd4c6f9-6115-4f47-8443-9d96f9517476", "value": "Hospital.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46b62cb-3f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776988469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988469, "uuid": "0a330f91-f6cb-4836-ab49-5d815de4f7cc", "comment": "Malware payload", "value": "0afdd2e445f578b8e6587d1220cc6606", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988469, "uuid": "fc70c686-1354-4591-8513-720ea3930006", "comment": "Malware payload", "value": "34330b921f872bd5ef6656dba547c8cb71aec14c4ae7b4b7dbd44a92027f26d9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988469, "uuid": "10b06bc5-9f58-4b48-a778-e9dfce23494e", "comment": "Malware payload", "value": "8cf716c261fce50bc3084869e957a88aaeb3f32d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988469, "uuid": "553e5f2b-16d9-40bf-95d2-cc8c900ed960", "comment": "Malware payload", "value": "8f56bed5c3afc0c7a6ed04965bfb23803d26f9c5e97b73a72113eebb9edf2c39dd2adebd73f16069a1fe32559e77a5a8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988469, "uuid": "0e1bc9d1-431c-486f-8905-3d62b71b3beb", "value": "T104D3FEC85ADE89B4DB1F647C451F5C069A8EE223061DC9D0BFDEAE843F216B035BA5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988469, "uuid": "1701d9bd-f6e6-4d4d-99a4-ca19029b6c25", "value": "768:yNRrMvXw2y4BOwiGuVPRahZYtqpK5606k6X6n6Q2DLyu8iYtnu0aVk8dJBVz7w+W:6rx2C0DAcdZsvZ3bSc0Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776988469, "uuid": "a0ca2642-c8af-4d40-85a9-71313f126d4e", "value": 132662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776988469, "uuid": "b1f4c323-10c1-4d4c-8399-d825c977a604", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988469, "uuid": "0174a540-cf5f-47e9-baec-187781cb3811", "value": "External_Template_Updated_8349.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1fce2a-3f31-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776961554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961554, "uuid": "9d9744c1-9dd3-4f12-9fd9-8ca25c1dd6bf", "comment": "Malware payload (ValleyRAT)", "value": "5be24ed89c43ff0cbaafec4eea31d219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961554, "uuid": "e19b56d3-de27-4ca2-aa0b-1aca25a73806", "comment": "Malware payload (ValleyRAT)", "value": "346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961554, "uuid": "f143c9c2-77cc-4cab-b4f3-4415061d1a31", "comment": "Malware payload (ValleyRAT)", "value": "0a3918750cfc50272953d53813963256f5ebd61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961554, "uuid": "36dcf981-4923-41f7-bc6b-4f984a7794b2", "comment": "Malware payload (ValleyRAT)", "value": "48b59d32ddd9dc76d424571a8094dfc38272986f02221da53f4b383ab147eaf27a954f76a3bb10693fed17a20ab2f6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961554, "uuid": "48dbbc73-d15a-42d7-b063-c40115c97484", "value": "T133F6DF03ECA614E9C0AED5318A6395527F317C894B2163D72B50F7287F76BE06EB9360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961554, "uuid": "39b10a02-7e1b-4e03-9125-b8802e230df0", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961554, "uuid": "e0c7558e-35f4-4e7a-8d6a-cdd01170f39d", "value": "196608:kPAVbQ6QH35kTwRzpzLpGxW+LIuvHa3zYqvD188:kOEWo1aKjYqr188", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776961554, "uuid": "4c8b430c-20c9-4848-b9a4-dd83f06b8a00", "value": 15789568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776961554, "uuid": "ab47032e-a444-4d7e-90c1-8f60d2326d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961554, "uuid": "aed41a85-efc5-42b6-8d86-35e176591b8f", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u6c49\u5316\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcfcf2e-3edb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924594, "uuid": "d411de2f-0fa9-4c8e-9f18-788f06f77ae0", "comment": "Malware payload (Mirai)", "value": "68e8cc0ab40ef8d8e977736c6b69c90d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924594, "uuid": "862edb2d-0b15-47ac-877f-35ee0c7d1425", "comment": "Malware payload (Mirai)", "value": "372c3c0244e45445e8d9fa31c43321f6036ba113d0c31303989d3613837c8a3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924594, "uuid": "e4b835e6-ea02-4658-be78-18b56319fe5c", "comment": "Malware payload (Mirai)", "value": "0b27c87d755c06bd7e9f6d8a18b9837f3eadc39a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924594, "uuid": "3b7cb3bb-b7ca-4c01-9264-8bddd9f7cba9", "comment": "Malware payload (Mirai)", "value": "868e3cfa1383b1127826ee8b1c2f8048e1b62b7e1f960744c7f78afec02f6b0cac0faf235ad29188431069cfdd4f77eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924594, "uuid": "375f55c8-cd45-4027-bd43-a79740b5757c", "value": "T1C42309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924594, "uuid": "23287f30-cde2-4297-bbda-d244bd78b094", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2ibe:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924594, "uuid": "3f499fcf-1837-47d7-8d77-4611e3920971", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924594, "uuid": "19534c0f-e524-44f7-91c4-b8223e600724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924594, "uuid": "f6155d9b-8f82-4487-ac05-14b4d6355ede", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7623def2-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923054, "uuid": "817272bd-eba2-4d80-8e74-d119b52c28e4", "comment": "Malware payload (Mirai)", "value": "2e1834b73cf2cf8cfc987c5e9600120e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923054, "uuid": "5af42db9-841f-42f8-9771-b2e6bece3ade", "comment": "Malware payload (Mirai)", "value": "372e4581d02ca3de78cbd40019c31c7edb3de9c2bcb4e707ff8a068b100409dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923054, "uuid": "61996ac4-4e99-4315-adcf-5ca959a75917", "comment": "Malware payload (Mirai)", "value": "983ebe587bc96d52d64275dee8dcd6aac8f1572f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923054, "uuid": "34ad8025-bb61-4149-a3e9-9c774622727b", "comment": "Malware payload (Mirai)", "value": "a8dc5b5ca19c0c61df2a47d28b25a81bd1243f49d2941164a40b318fc001640c96cc331ed18ec93eb272b9004faa458a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923054, "uuid": "9787907c-bfdc-46fe-89cf-af8a81a8ed02", "value": "T1C7B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923054, "uuid": "4089b7a6-cb85-4ab1-b05f-8eeda1d6bf2c", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1m/LWy:c9sSyzz36YaWWgg1mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923054, "uuid": "babc637c-0bbf-41a4-ae94-0892af610afa", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923054, "uuid": "db869fc0-b85c-43aa-952d-7bbe4e0f0d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923054, "uuid": "c1ce75e3-13a5-45b1-a4d3-f99d6b9d1598", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed946395-3f1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1776952890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952890, "uuid": "57929df6-ae84-444a-9fb7-9a828fd3a30a", "comment": "Malware payload (Havoc)", "value": "14f82c885df2581ce240ea4f52e6b235", "object_relation": "md5", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952890, "uuid": "7d1aa1b3-429d-4592-bccb-c4658079c79d", "comment": "Malware payload (Havoc)", "value": "37892e022ed9d1a7788ca4b59ce671945c6ce4b03ba758beb75792588677702a", "object_relation": "sha256", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952890, "uuid": "be08ffd5-6d94-4cc0-a6d3-a3a961888118", "comment": "Malware payload (Havoc)", "value": "558f365ae9587842d9e451018503b1ae07c378e8", "object_relation": "sha1", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952890, "uuid": "b4208170-e5ca-4c34-be0a-8fa2c69a55c8", "comment": "Malware payload (Havoc)", "value": "0808f8d7fba62030904adc3ace7f08cab18e2313b8ef4961cf6aa8f8cec7bc9847e47ace18752dadb063aac7fa83ffe8", "object_relation": "sha3-384", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952890, "uuid": "2d261f61-3774-4eed-9a1c-061d0960cf8f", "value": "T1405533649BBFF6B356432179AE9EDE40185A8F56607E55C3266CE0F89C28DC4F90B303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952890, "uuid": "d3671eef-e79a-467a-84e5-d0d579fc126a", "value": "24576:zJ/Fpe396gpIWVUvy5oltEcJCtnX21opOAnJeJWletA/GoK5cYrgE1vYsJ:zJ/3E6gpIWVUvxrEtnX2ep/4JHA/GT5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776952890, "uuid": "b778e49a-85a2-4b61-8c19-bf4cbe1b3544", "value": 1324169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776952890, "uuid": "978e3dc7-0294-4bb2-adee-cdd194da041f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952890, "uuid": "7f417008-bc9d-4197-8b9d-4b6b67ab1356", "value": "jh038x18gy9.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c1a4ed-3eaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776906060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776906060, "uuid": "781745f3-c088-4f2f-bc3e-480a77598922", "comment": "Malware payload", "value": "07c0edba400ba56561958cd7d38e7e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776906060, "uuid": "b59ee86d-786f-473c-8329-e6050b67571b", "comment": "Malware payload", "value": "3850835d2e9d4a9e710787c0fa048c469cb6fe835e492e550f3356b6ed1dbc3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776906060, "uuid": "b7b831da-f044-490a-b539-8b58db7ae9dd", "comment": "Malware payload", "value": "dd041c6c0ed144a683c63a7e01066ec4e286591e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776906060, "uuid": "7afb9321-b800-4449-8850-8417f2894ac5", "comment": "Malware payload", "value": "deabd77c575825144da8b2c4521f6468763e8c9098363415c7248d2db0a5639d86210cc872ec42228092d8649fc7d803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776906060, "uuid": "022e8493-91cf-4e42-960c-0123e827cc9e", "value": "T1AB27CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776906060, "uuid": "bb78c633-184f-4b28-9473-042a3485c30c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ2:cqYUQuVDt0TZEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776906060, "uuid": "2af6f58c-a8b1-423f-9695-1ffaef3b4447", "value": 22020096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776906060, "uuid": "7faf4e79-98d2-4ca9-8514-599b39c5f323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776906060, "uuid": "f7993c19-b8bf-4c71-8781-a6f753d11c6c", "value": "3850835d2e9d4a9e710787c0fa048c469cb6fe835e492e550f3356b6ed1dbc3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de1230c-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776931630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931630, "uuid": "4535fe02-7353-4622-9c56-475f6006110c", "comment": "Malware payload (ChromElevator)", "value": "421137e9bba564e009ddfd4ef6cf9d34", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931630, "uuid": "2b846da6-639b-4ba0-b6d5-3d856e81225b", "comment": "Malware payload (ChromElevator)", "value": "3851d09a72fde3af194e141dbfa63b5882c77c30775462b005f79b653b49e01d", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931630, "uuid": "f1ab7423-04a2-47ab-bea8-9b83be754359", "comment": "Malware payload (ChromElevator)", "value": "c645a24bc452c7c377985387aa2ef890e37f7ab1", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931630, "uuid": "a019088e-6388-4fbf-b1c9-bc6d4f41cf0f", "comment": "Malware payload (ChromElevator)", "value": "6af9521d1608f9fe74a9293f8168a1ec8ea2b05de61d7f6882f5c713ea1b74137980bfc76cdd8d723a2ff5954bf614f5", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931630, "uuid": "0f063497-a325-402b-a980-56bae2214b38", "value": "T1C5347B47B26961E9D1BBC13885922612FBB134610731AFEF4764433A5F23AF4AE3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931630, "uuid": "d3d44926-401f-41c9-a477-58a5faf83c43", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931630, "uuid": "76da8547-b50e-4b1b-b0a3-5efdf163e99e", "value": "6144:343tx6VVucovT296yqttyNgD6ItMwPvkgiY3R:3gtxcuco729JO2o6I/nkg9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931630, "uuid": "ebd0d3f4-9f4d-4e89-9e3a-939310d227bd", "value": 244392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931630, "uuid": "c5aca75a-6d30-4361-ab23-7da9b8d14fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931630, "uuid": "047c0a3f-c11c-4a42-8574-2c803a3381a9", "value": "Payment_Advise0927345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684a249a-3f1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776952237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952237, "uuid": "4ecefe4d-4ce8-4141-bea1-a89c2be54796", "comment": "Malware payload (Mirai)", "value": "00c059e10d33454bca9219ae97117d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952237, "uuid": "affed146-c241-4087-8a50-473a64cd0c9a", "comment": "Malware payload (Mirai)", "value": "385f1a7678934594c400f8994c6dd8d1a06546a97485d34ad55652965ffc1e9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952237, "uuid": "e5f97c23-70d8-43f2-8474-d2566a426c3a", "comment": "Malware payload (Mirai)", "value": "d83a78427001dd7a1889d3cf2990f943e94a604a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952237, "uuid": "3c4af958-f25b-47d1-96a6-a1da54d4c205", "comment": "Malware payload (Mirai)", "value": "1b5832fffe557aa896e27b170886954b5bb5d9ef921f9598b6a16379aa888e4a66b76d685819e7bd0b039530268100d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952237, "uuid": "6b07baae-e01b-43e7-b810-239a60452b1a", "value": "T1AEF3FB71984CE6C7C53321BCA0ED9FBA8E7E72DA2749CD027DD161319AC5EAB3906C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952237, "uuid": "ed079637-e4da-4b47-886c-f4e51d84a86e", "value": "1536:b64M4J74RUOPPKjaTnQaK+pK7DKrtwp+Vp+wEi4S1:b6WOPCuTnQK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776952237, "uuid": "2b416e81-fc09-4bb9-8468-43bc81385b83", "value": 166064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776952237, "uuid": "a8f6c030-6bb3-4983-801b-a068c41d7705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952237, "uuid": "eca972f2-e97b-48d4-b845-631dc131191a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc537f67-3f3f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776967866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967866, "uuid": "e7966ba9-a135-469e-a349-dc12af071ba7", "comment": "Malware payload (SalatStealer)", "value": "453eadd1fb19b2674d74a65c4aca105d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967866, "uuid": "bb75c95c-ee18-4910-b304-0554dc1b3b9e", "comment": "Malware payload (SalatStealer)", "value": "39003beffefcd5ef0daa54f5690ff76a7bf48e5595d72de7c176e25bf6db79e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967866, "uuid": "8cb751fb-2226-43f5-8c38-ac5b40c9d085", "comment": "Malware payload (SalatStealer)", "value": "21be4dd1a415806602a4a75917f010c46b57bdcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967866, "uuid": "0530c811-cea4-42f3-83a4-25e867d28a63", "comment": "Malware payload (SalatStealer)", "value": "6a4e713d8933978921a2c0b9614d3a25bfc9537ceb13c1ff0b1e7af7de543c8f12ef3ad5c94b392e8ff9bb0582e7ca2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967866, "uuid": "182852ee-62bd-4ab3-a0ec-27dea89fc2f7", "value": "T14FE533B6D2C2294BE72B6C384D34DB170CBF570984F68A102D21B7F6E397276D939894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967866, "uuid": "e826bb68-1421-4957-aab8-ac9272096edd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967866, "uuid": "d3b04565-1f66-47c0-bc24-e157b3947ab9", "value": "98304:L9AGByH3+4Gff9k6hh6QIhWmIVrrpVTo6Xyr6vQO1Lz+:L1Ym9k6h4QIhOhrpaUv1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967866, "uuid": "4d2834b9-0a7a-45a3-9a16-5f53005cd3fb", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967866, "uuid": "909c1588-479e-4f7b-a0fb-6e931e59780b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967866, "uuid": "fb6e36c3-4dd3-4909-a10f-0c675727da8b", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318ce9e4-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976197, "uuid": "e84be8be-adb8-48fb-9d42-83f01f7ccc53", "comment": "Malware payload (Mirai)", "value": "ac44638d496587f83fe713cbcbd44e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976197, "uuid": "7d554f65-726e-40f7-9d84-01e6319f1e2c", "comment": "Malware payload (Mirai)", "value": "391895724431b2e656fc557b81ff6f81c075b442b262b2dd5d245c651bfceeac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976197, "uuid": "a18fd40b-ff47-4eea-bae2-9d2bfa3cd9c3", "comment": "Malware payload (Mirai)", "value": "1efc282bfc92e6c1df0849728badacd47e9772dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976197, "uuid": "7b8b6c07-232e-4ea2-9099-6685c9a9b38c", "comment": "Malware payload (Mirai)", "value": "bdda94f7248e83e33ca58ee537d92ae58d1f38a2bc3168ecaf23dad387c20103610e4250cfd56981cf5e93760f7890fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976197, "uuid": "56b2da2e-be8b-41db-90bd-59b5cbf12a03", "value": "T142431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976197, "uuid": "2094ad8b-c69b-4206-883c-59f63c7a3405", "value": "1536:1XIY73si3qEToSRhINNQ/K6C8u50pfEHwNLW:2Y7H6ETRhIY/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976197, "uuid": "c6387ab8-934c-402f-a375-751eef18b9ce", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976197, "uuid": "16623ebb-5042-44e4-b847-766516a5d8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976197, "uuid": "6449d13d-820f-4f24-a640-812407de6dd6", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218950b2-3f27-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1776957272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957272, "uuid": "86b24a4f-9a5f-4ba7-b012-037cb0a4e076", "comment": "Malware payload (AmosStealer)", "value": "98456f82aacf79af275616df48d53f51", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957272, "uuid": "dddcdf2e-8434-4645-9d00-ef1d0d03f55c", "comment": "Malware payload (AmosStealer)", "value": "3aa43ab301b31b360585f71fd23050fb42311d09cfd406d4b9fb74189ed1cb2d", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957272, "uuid": "db8acaf3-9652-4a8e-906a-033d3d83fe6b", "comment": "Malware payload (AmosStealer)", "value": "bd995626da0ef62c8c5b7e1684de4cc5befc518b", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957272, "uuid": "13264904-aaf3-4e72-a34e-d2faee8db9e5", "comment": "Malware payload (AmosStealer)", "value": "5b0ba68e057e85a364eccaab10bf43ad90c369118437c6c19fadebb2a77435cf7d56969d60f718855ea7746e55f19841", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957272, "uuid": "2cc4d78f-c0f9-4e7c-a6a2-ed55b6ce16f4", "value": "T1FFC69E093AA8A468D83191F71F38D5FFC3FCD7DA5540B26FF09E0A9A941ADDB60B4109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957272, "uuid": "11bb6554-adb8-4853-867f-b59459f801cd", "value": "49152:mdePteLsE4W9W0L9GMWO2AmO7pgZAc5TEMaPLUr9w7EBuoOO7pgZAc5TEMX3:zuL9XWGmOaA4ZaPQr9wAXOOaA4ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776957272, "uuid": "448c55bd-d177-4086-9faf-cffe60289c3d", "value": 11711608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776957272, "uuid": "0f09ce48-500d-4cc0-abb3-bbc868ff5ab5", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957272, "uuid": "f76cf247-44e5-4a4a-b834-4fdff4cede06", "value": "3aa43ab301b31b360585f71fd23050fb42311d09cfd406d4b9fb74189ed1cb2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d8ee62-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927909, "uuid": "57b5b7ee-63ce-4480-b3b7-44250d3b352d", "comment": "Malware payload", "value": "d6ea9892a1d9ada243fe29acdfb18452", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927909, "uuid": "ceff4be7-bae7-4005-9cda-d3138d9149d6", "comment": "Malware payload", "value": "3c6cda1b28e26d2408fbc1a3054b1b9775cfde7a20196433ddf58ee9e5325d61", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927909, "uuid": "c609215f-7594-47f6-9e9b-9735c4cebc66", "comment": "Malware payload", "value": "02c3bb1bd5baa658b361dac075da068c3055e5c3", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927909, "uuid": "08de4273-c40e-4ee4-80f4-07142444b4d5", "comment": "Malware payload", "value": "1d5847fb1f6bf0ea1a7b2aafe799033cbcd9863b00402071bd0650a33e38e6830d3aaf7fc5d9bbe6b8ba16ed042d1227", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927909, "uuid": "ebb6e254-8277-4b90-b1bc-87cc3f06ea7f", "value": "T1942723224DBB8B0D47A5B8146D3E39CE15E9CE64850C4C2246E270EFE91F60C97B76F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927909, "uuid": "8e9c5e51-e704-4f69-800a-3a821f90ddde", "value": "49152:A/8/Q/c/i/X/R/n/c/G/t/a/FiTe/g/M/7/s/biTT/b/5/6/W/T/a/5/A/9/d/H+:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927909, "uuid": "4f1717c5-7a4c-4d23-bd43-391d04f17cb5", "value": 21611505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927909, "uuid": "b86eb169-0ae7-41e9-a1fd-19b5f8714068", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927909, "uuid": "9e33b0e4-65b0-40a8-aa8f-3911c8fd80cc", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14c5db1-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927878, "uuid": "2d8c796c-72ee-4a3a-950e-70a1f1580e2d", "comment": "Malware payload", "value": "d4c286f8898339c727b6f40598726382", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927878, "uuid": "c653dc6a-634b-4230-af47-d69831b6ca91", "comment": "Malware payload", "value": "3cd95e84a58be473631fab012af4841c206826d736b175c46514ca25940bfdcc", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927878, "uuid": "eef03443-4310-480b-87d5-33f82396caa4", "comment": "Malware payload", "value": "f7d888c54a97cce7e2206217c0efd8831a93f1b1", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927878, "uuid": "5403d4e1-7a27-419d-94b7-5a6adfaf73b1", "comment": "Malware payload", "value": "3665448244129c16680cea32d84a64c955e50ebef862f00b19db40d14ff8c18a1213650c2324d90de4653a5080a6d036", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927878, "uuid": "56d2afc8-c0c3-4807-b8ec-cfcfe2de4b61", "value": "T16A27234414ADFE7A87B8231F00591C4EE5ED9E262094F339A4CF65BF689AB0B353F815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927878, "uuid": "f0ee1c48-771b-4363-9d27-fe4ae1a09405", "value": "49152:+f9fAfqfhfDfJfqftfAfYfbfytlpWhfXfGfOfDfmtlpW+flfifpfifefBf/fvfgZ:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927878, "uuid": "dd350aa5-9872-44e7-91f7-a2a7584b9b27", "value": 22091515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927878, "uuid": "f86b5d22-1ab0-44af-9527-0536f7256679", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927878, "uuid": "d1d29cbd-59b0-4f1a-8cca-ae861fd4394f", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201904fd-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928064, "uuid": "296f88b3-88d7-4da2-8714-32e59c12d8cb", "comment": "Malware payload", "value": "161daaf185af286e9f6034892438c84d", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928064, "uuid": "881a742b-c395-4b6f-93e5-913c49de6aa9", "comment": "Malware payload", "value": "3cdabf8f8aeff462970f1aef19be37e6eb90765ae7a861b64aab16b9c828c3e2", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928064, "uuid": "799736c8-0c1a-439b-b4f3-dcfe9ee0c996", "comment": "Malware payload", "value": "a5b1256db391703033c7b4398ae755cb585c77a1", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928064, "uuid": "80bdf57e-485a-40ea-8d86-2e7360b86cbf", "comment": "Malware payload", "value": "6ab9e0a6d91f119a7e96af1310d966fc3c4327b2f3c2058ea82ecf290b5df2c37a468e7825bc7c266beafa5ecac84759", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928064, "uuid": "061269b6-6889-4f6c-985c-09273095d25f", "value": "T18A271247CA2D5B2E479C139C096F228E53EDCD09F81198B337D53EA47A2F48A1BC5E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928064, "uuid": "564c5fc1-cf68-4ed6-9987-4a451742e710", "value": "49152:0O+ONOIOMOjO5OZOlOmOjObOthlxOUOqO/OQOthlkOtOEOiOAOZOVOtOjOKOfOtZ:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928064, "uuid": "6bb63849-5f96-42c1-b321-7ad681551fe4", "value": 22091527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928064, "uuid": "d982e8d6-044a-4a28-9079-fcd0c2528ef2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928064, "uuid": "1721feb0-a61f-4e87-937f-a07583c0bdce", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb9b58c-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776928142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928142, "uuid": "fd42b357-f1c4-4ae4-aebb-7cdfab80585b", "comment": "Malware payload (CoinMiner)", "value": "078ad7ffb2a841b3b343e83399f1e8fb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928142, "uuid": "b48efed6-297b-4f02-8a74-3e3a69d2efcc", "comment": "Malware payload (CoinMiner)", "value": "3d03fe9ec0d2afb3bd74a8739b30fe1fd515b4eab9cdab3e4f56f5a05d3331a8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928142, "uuid": "01fe955a-a155-4f7f-8278-f60c53b8080f", "comment": "Malware payload (CoinMiner)", "value": "97868111f4c04119a2683dd59b4ea7959a83c9d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928142, "uuid": "7a55ae2c-7d52-4e98-a514-0d4dd28d36ca", "comment": "Malware payload (CoinMiner)", "value": "5517f0ed37b49fb9d9e14ccf03dad65845768096552eea0f51dfa5b5b7ddaee53dddff4c48a19658fb2b85f1d06e13bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928142, "uuid": "302e949c-ed0f-42b2-9bcf-946832b30b07", "value": "T1E022091A7E854231E39089F05579424B653D6523E783A3EFF773959A0BA63888810EEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928142, "uuid": "bf033dce-6fb2-4eaa-b6e3-632bef5613a9", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928142, "uuid": "435d5f1d-295e-4e3f-9952-58869a981596", "value": "192:SzoyFQjBAx+e+lOzdznPFJxTEZmFhSKsXFh:SzoUQGw1MJTPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928142, "uuid": "df27287d-2f87-4b4e-ad7b-ee22a4ba33e9", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928142, "uuid": "ebbe7aaf-3462-4002-88cf-1cb9e8b683b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928142, "uuid": "906631f7-f18b-4b20-9e9e-9c472196d080", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89a2261-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1776945983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945983, "uuid": "3a4d3cf8-413a-48aa-a2e6-828768b9f705", "comment": "Malware payload (DarkTortilla)", "value": "2f0114b3e40c09425695c1be8de01437", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945983, "uuid": "67b338b0-4aba-4789-9ae4-d3cd79271255", "comment": "Malware payload (DarkTortilla)", "value": "3d1bdf5005f74dbe5540f4b689376d0de59068379ea7d7238735b37eb847f0a5", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945983, "uuid": "62fe0116-e7bb-4626-8e8b-7007ba7cf35e", "comment": "Malware payload (DarkTortilla)", "value": "1eca7f586a42c19115760490b50ae19512729947", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945983, "uuid": "9d9810b6-2cd8-48bd-a532-2723e03bee27", "comment": "Malware payload (DarkTortilla)", "value": "1908890305e4c6460d888cc9017db29e55c5d1283bc0e6f6dd1f90fa7c7f869318da0bfcec871c4149ceb8bae4768c18", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945983, "uuid": "39544e73-6bd9-4821-ad41-2a1544971d32", "value": "T1B5E4CE228F476F99E53E4B3CC112048437F4D88A9763E62B6FF800E75E66F85CA67452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945983, "uuid": "6b063749-8a91-4424-9548-bf40ba92fb52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945983, "uuid": "d5cb31c7-3859-431f-a8eb-92af908375c3", "value": "12288:SRzDCHADA+YbxTXO+MriwQUaYeP4SQG4zuEF1a4:kzDCHFLNTHMm38ePPMj1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945983, "uuid": "6420b990-818d-49e5-b201-5c04c470a6f9", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945983, "uuid": "c98e8abb-c693-4f55-a958-88bc1e743565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945983, "uuid": "4c9cf9ac-6263-4c17-a50a-ce6445115e2e", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d8277f-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926575, "uuid": "22c37169-3e87-43ea-bf4d-f63888e67c65", "comment": "Malware payload (Mirai)", "value": "b21116ebd57d53104614c7bfcf3207c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926575, "uuid": "efa5cd26-d00a-42ff-8333-8861490cb52f", "comment": "Malware payload (Mirai)", "value": "3d6d40301232f997283b70dc806849fe815b25c7e2422822b953e4321a05a9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926575, "uuid": "93fb1a53-9e38-4ece-8f03-e4237f4ec8bf", "comment": "Malware payload (Mirai)", "value": "6235f419686154e455de018d9ecb53ce63d130b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926575, "uuid": "a07375a0-ae8c-4cfa-9d13-026c55303eae", "comment": "Malware payload (Mirai)", "value": "692092e5797127ffe5ddfc80253d3a1876e54e07c386cfedb8ae6e33b7adffd20aa0504f01ca1e9db862253b9e530813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926575, "uuid": "4d0432c5-d0e2-408d-abd7-6c8002d48973", "value": "T13CC32902F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926575, "uuid": "77f098e7-a966-4409-b762-a8828436561d", "value": "3072:b483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BeyPBupmzQUAdojgaR/XN:bH3TghM/1weZbcnITeyosFAIxnJdhgJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926575, "uuid": "72e779c4-0477-4f0d-8e39-1249e37f613b", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926575, "uuid": "7fd663eb-5db9-4b20-8a7a-89f36869c717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926575, "uuid": "21f6f268-deb6-4c43-8e39-6438a43f7ebb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baed142-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928083, "uuid": "27825cdd-ecc0-4528-a5e4-d035217b5c13", "comment": "Malware payload", "value": "ddc0d330c99cc954ce75a09d1aea1431", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928083, "uuid": "72565985-86b5-42cf-b9b0-45183cb8b4b8", "comment": "Malware payload", "value": "3da7e80c3ad5d584a4d2cbcf056c3e921c1cec3eb64e62f61d0e8720511718a2", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928083, "uuid": "c8aa600e-2acb-4692-be60-e0bb01e459fc", "comment": "Malware payload", "value": "655139aaa1f1c506fd9056955e04b744bd763a36", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928083, "uuid": "f3aef781-5825-4996-97ad-9629798bcab5", "comment": "Malware payload", "value": "7b629d748fc01d321280e2a0a841326ca813de8a34b20950e466281ce6c007b5bf120407072d35cf81a7e13daf78d6a6", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928083, "uuid": "61ebe153-1133-4061-89b6-9fbef37ec066", "value": "T1E52723154F6EEA5882DC26FD307A4F0D256EDD08081946AC90773CE864E7EEE15C6BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928083, "uuid": "5821b51a-16e8-4ce1-82cc-aef8f98675ab", "value": "49152:8injByinjB7injBwinjBKinjBhinjBXinjBUinjB4injBWinjBCinjBSinjBGuix:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928083, "uuid": "a6a43a4c-b340-4646-ae41-b619d02b171e", "value": 21371495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928083, "uuid": "a38bde43-1ade-472c-936a-365247ca251c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928083, "uuid": "effc739d-3e54-484e-83f0-6cb5385be2d8", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052aadda-3ee0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776926730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926730, "uuid": "a490aa1d-8d1a-40a4-ae04-d1c5757916d6", "comment": "Malware payload (AgentTesla)", "value": "a8670bbc5fe24e7c47b80bd13f36527d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926730, "uuid": "9604c48a-f404-44a7-bb10-d679a59ffc49", "comment": "Malware payload (AgentTesla)", "value": "3dac52fb06fdd36e5aa4fd572b2a05d6cf3d736ec8a2d487e44b828821a7ba3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926730, "uuid": "23668907-b951-4759-a89d-15b47cd96f93", "comment": "Malware payload (AgentTesla)", "value": "bdf2e87fb9c0abb8e3f523134e251b0474c4bd71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926730, "uuid": "1b9ec512-a3e9-4840-8713-bac68d4fc39b", "comment": "Malware payload (AgentTesla)", "value": "bdcead4177fe54e18913b206dd854e4b8d3229082972e4b5aa89a6b807660c33e84904d06335b6674919406044203c87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926730, "uuid": "ec6a0686-4cc9-4a06-9668-6f44bdcfbb49", "value": "T175355A60E7C9DE10CABB6D316BA15D54EE3460E355218608F4ED3A27EF7394349333AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926730, "uuid": "d85c8be9-766a-4f08-bb47-39bb50e9c49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926730, "uuid": "65c03ee7-7e57-4008-8f6a-bbede4aa3c02", "value": "24576:ynmG24pcFaQ6jkqj1iAWKD5Fp1UPVFFK:yH2acEjkqjuK1piFFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926730, "uuid": "64c6462e-1719-4b78-8bec-a6fc60cd58b8", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926730, "uuid": "1e93036a-78ce-44a3-a22c-9e09e4440977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926730, "uuid": "3b6c3d4a-09f2-4390-b81a-58580d03ba46", "value": "3dac52fb06fdd36e5aa4fd572b2a05d6cf3d736ec8a2d487e44b828821a7ba3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a90de95-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776928484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928484, "uuid": "70020217-4af7-48ea-8682-f9ade33de349", "comment": "Malware payload (Mirai)", "value": "02d32ca18339fe4eba66030db1f74724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928484, "uuid": "73e042fd-9f56-4c6c-a110-293e84e41865", "comment": "Malware payload (Mirai)", "value": "3e3a13f953bb69f4d49ab308471ae757f9b0e470b87b58b93b5b2e719eadd764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928484, "uuid": "dd2dbfa2-5e75-4ad4-bc4e-fe50fd432945", "comment": "Malware payload (Mirai)", "value": "8428cd9ce35e71bbdc8326b25a6a3b84158fc865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928484, "uuid": "f0a509e2-352e-43f9-aa99-78a67172f8b5", "comment": "Malware payload (Mirai)", "value": "a1b025ec3110cfeb12f779191e8bcaf979d84b658c5f25de0bb9d8210886e8bdd5ea56c043f9668128056b25104467e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928484, "uuid": "c66bbc48-1a8e-4cc3-a426-f9662aff43bd", "value": "T183D35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928484, "uuid": "db171a95-00a2-4a25-b29d-fd7cb0538aa9", "value": "3072:bV0zui1ZhMHJCIqWrpP7OUK3y0uMg9FkiH:KP1Yiwd7OUKC0uMg3kiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928484, "uuid": "2c8f3934-37e9-4971-b9c2-0d6297593927", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928484, "uuid": "07fe7488-26b8-4f17-aaac-701dc2c0b6e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928484, "uuid": "295e4bde-eec1-441f-81f7-9c2914f09686", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56504b0-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956661, "uuid": "650d18b9-82f3-4e29-aa5a-bbf964eebfe6", "comment": "Malware payload", "value": "3abfb7267c4207eb64916d0c44662a35", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956661, "uuid": "9a00b34e-6fbf-4293-969f-cd4be7e5b879", "comment": "Malware payload", "value": "3e4115bef12962b605b64d2e1608398cceed8adf6b0f5262931d5b174acdd623", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956661, "uuid": "b22aef1f-6387-4605-8561-c0995258cb5d", "comment": "Malware payload", "value": "eb4b3039641c626bc263987b89a021618954ba20", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956661, "uuid": "234a0f94-6dfb-4f76-b52f-869e55a4466e", "comment": "Malware payload", "value": "d451f37c42b197d25c9c0de8f0787bf0a0ed8b0da7a7941bd650eb665c7eb7e5f21911038fef54baf6a52324dbb4c37c", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956661, "uuid": "4b640213-69c9-40ff-b646-8a8083620bca", "value": "T113855D03E2A360FDC16FC13487D69B72F53074684134AEAFA2D1C7352A74ED05B5AB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956661, "uuid": "5757c7f7-0203-4fb4-a81e-6d7ab31aff91", "value": "8ea2ac051c081c8f14a900919120809a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956661, "uuid": "6020d492-e75f-4457-8f87-b8788cd32033", "value": "24576:UtNbYhB0Tg7z528Rpqi+enRSd7zTbZrVhuEmOtz0CT3d0CjHOcI7hhfGiVSbrDA:OaUiz887+enC7zH8EmOtzF36CjuarD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956661, "uuid": "68e7b8cd-164e-4a72-a425-10b48b50d642", "value": 1743872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956661, "uuid": "3a3cdae6-9457-4a6d-b228-0fc25f8a3896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956661, "uuid": "832d6d31-3d4c-4d13-87bf-e65d05b4fd44", "value": "3e4115bef12962b605b64d2e1608398cceed8adf6b0f5262931d5b174acdd623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c32ee2-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "39ccdca9-6c96-4aae-b80e-816fadd1cedf", "comment": "Malware payload (Mirai)", "value": "f140c4750ab48390ddd33c238fd0ba7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "b5d87e1c-e12c-4221-ac57-1f30e8d16a33", "comment": "Malware payload (Mirai)", "value": "3e7319032ac653d9d6c2b28abe933bdee85b65562411709d21f40e23df66df33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "53080f94-3a7a-4305-b3e8-08b34c4e5174", "comment": "Malware payload (Mirai)", "value": "cefd8bb09786503e8c326266405956dce1229733", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "8548481c-c8b6-428e-8532-3ec6a7e94e44", "comment": "Malware payload (Mirai)", "value": "09119501311c35a4bb15b5d7cd4b885748b0ae939ac269146a2e5b5bedfd2145a14609277230419e35ad299419145a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "7f033a93-7b19-4798-b299-72017241f037", "value": "T15FC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "29ca1186-023d-4a5c-9a30-a453efeb1be4", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoZrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIZrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923099, "uuid": "0f051580-182b-4008-a245-80d310d1bf37", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923099, "uuid": "c61e03ea-2f15-4f93-a397-675120ca75fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "df2977d0-286d-4101-b99e-4a29cddaebb7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcede6dc-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944755, "uuid": "84cbe7be-d1ed-491c-8935-88117fd0216f", "comment": "Malware payload", "value": "5c4755fac85b1acb87dc7a22e949a3a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944755, "uuid": "f5dc13c9-49f0-4151-a7db-662e6ea7515f", "comment": "Malware payload", "value": "3e8ef24c3a9f6f883acc91499080b2fc68b53004e0ef68aa82f7bbf8cfc4a991", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944755, "uuid": "8389d367-b9f6-48c4-b857-edcb130d66c3", "comment": "Malware payload", "value": "98f0d6752ee067449a0678fafb43ea3abfab5487", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944755, "uuid": "4b33fafe-1afb-45ff-91e0-acbfb66cfbc1", "comment": "Malware payload", "value": "87f5f050b1708a45a9618ac3d347601e4f31e85f64ba070c8618b63f1adc4e567850c5f88a483351b0d2bc70e1ef518c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944755, "uuid": "19833c84-ebf6-4b97-9047-ea6ac4e85ed6", "value": "T1DB710106DBE44527E0B70734BEF30B566AB4F8A09B63572D49A14228BC713941D72FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944755, "uuid": "3566eb5d-67b8-462c-9696-9772eeadb5cc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944755, "uuid": "4aa1d1e4-dd56-463f-8f21-87cc166a307a", "value": "24:etGSv/E9OAzEO3h3LiLggLYVvs/FKtkZfl5moUFDst2WI+ycuZhNcFsakSfFhPNq:6wjWLggLYpsnJl5mVk91ulcFsa3fFTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944755, "uuid": "4f3a896c-0b47-4300-a6e5-adb3ff46a939", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944755, "uuid": "ee3ef66e-eec7-4d23-9450-bdf76c4336d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944755, "uuid": "64fc0a80-6bd4-40c6-81fe-aeb6d78c8e94", "value": "bc5oikdr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f6bcd-3f5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776980013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980013, "uuid": "200c07b1-3152-4c19-aa22-587d9d37d6af", "comment": "Malware payload", "value": "46c450d1e5bb9ea7b1929d2a365e5aa2", "object_relation": "md5", "Tag": [ { "name": "assistechasus-com", "colour": "#52F751", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980013, "uuid": "95f902e4-97ce-4b83-a7cf-93fa7508e45f", "comment": "Malware payload", "value": "3f4401fea1d28bca2a950083241cc3624a7549ae4d2e2fb9ee2ecddb73688651", "object_relation": "sha256", "Tag": [ { "name": "assistechasus-com", "colour": "#52F751", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980013, "uuid": "dd9a968a-e354-448c-8f77-3092c360cd2c", "comment": "Malware payload", "value": "bbc1b334803141603c781bcb3fbde093aaa91773", "object_relation": "sha1", "Tag": [ { "name": "assistechasus-com", "colour": "#52F751", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980013, "uuid": "7bb7dc5f-8447-4f69-abc4-5777194b5aac", "comment": "Malware payload", "value": "2b2c55ca70c0f3d8d1614af4498a0f5d4de7303970bd6146d34577330a05fff825eb34835e74819ef0081c2990b459a5", "object_relation": "sha3-384", "Tag": [ { "name": "assistechasus-com", "colour": "#52F751", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980013, "uuid": "1d2ccebb-bcf0-4ed2-a297-e7b53a36b7c6", "value": "T19956C013B648A53ED87B0A364837961058FFFEA1259EBC0757F42A4CCF7A1401D3A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980013, "uuid": "b763028d-8022-4cd4-b451-d04cd500d9fc", "value": "a71e803913d6100bbda76c8f836aeee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980013, "uuid": "e083a3ef-e515-4407-97b2-6b643109305a", "value": "98304:RCSMC/Ac5JF4rY3Q0YPEgRHTsm+MCvkBH+ex9taCXY:gvhY3Q0YPppsm+MCMZ7vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776980013, "uuid": "2c72bec5-7731-4457-abcc-f6769f372fc9", "value": 6011904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776980013, "uuid": "991e9c8d-6671-4632-97ce-f1155ed5621e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980013, "uuid": "21381401-3a0a-4904-abe0-8e2166b08cd4", "value": "3f4401fea1d28bca2a950083241cc3624a7549ae4d2e2fb9ee2ecddb73688651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85792c9d-3f2d-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1776960017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776960017, "uuid": "8fdb3bc5-9ab3-420f-969a-7336f6c559c4", "comment": "Malware payload (VioletWorm)", "value": "f20db1c1f3c1ce4d17515bb3ab693d09", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776960017, "uuid": "a9c45a47-ff49-44df-a4a2-5b9ee7baf783", "comment": "Malware payload (VioletWorm)", "value": "3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776960017, "uuid": "fdfdb2d7-7ce2-4498-99ed-57350f5b83dd", "comment": "Malware payload (VioletWorm)", "value": "d168cbd830136d7a377fc5914f846f400a98702e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776960017, "uuid": "231e1d28-48c5-4fa9-b84e-9423973f2f77", "comment": "Malware payload (VioletWorm)", "value": "d8a5f012b69882d652aa4d34194435998f6b278ab92887121dee1bea230c956fb7968a419cb0153479cd9c8cb68a2cda", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776960017, "uuid": "6e46a7a2-eaec-46b2-8f07-9ddba60598e1", "value": "T1C4E3AE1D53B220FDC15A827997D293B3F973B82027216BAE1398DE792FA4D417F2E510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776960017, "uuid": "b31c53ad-7010-4061-8901-7ce1792fc825", "value": "900998ffb3f12157e44eef1bede5e79c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776960017, "uuid": "3cfbef21-ded6-4fba-bc27-f89c1c456288", "value": "3072:aojIOiE6FVyp1r6z+TJdCJDBL8f90mgG1aSvACL:NAEKVyp1r6z+YDBLzKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776960017, "uuid": "077ce243-1b4b-4dbe-88e0-9aaf5eaf2a0b", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776960017, "uuid": "f8390660-675d-4223-9e2a-5c8ca8ad24fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776960017, "uuid": "e7810efe-aa5f-487e-bd24-039e584262fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e9ccc1-3edb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924778, "uuid": "75cf74f0-45ec-4a79-b700-9cbb402f2f4b", "comment": "Malware payload", "value": "d5872083e5270ce860627c321c4a17ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924778, "uuid": "701ecf89-3418-429a-976a-8ac4804e6b51", "comment": "Malware payload", "value": "3f8981f1a4160417e2859c31255e030de9e488eb032994cdc13681b091da1504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924778, "uuid": "1a35e20f-bd39-4fed-8bfb-a3f1ea6e4f4f", "comment": "Malware payload", "value": "a8c347c428a591ca38ebdaa905256a177288450f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924778, "uuid": "7fc57ced-3e6d-454c-ab88-117093bb9062", "comment": "Malware payload", "value": "d7ddac021c5712c0cbb7cb04099c7b1e0384748e5e17e12ae94c60bbc1dd24c1f677285af45b1227cb8455378bca2035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924778, "uuid": "76516958-3743-4002-bbab-fee7a5323f96", "value": "T1F315D0B1F64EC721D7880E32A4CACCA954E192FBC691EE6660907ED44B043C77FBC659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924778, "uuid": "454db80c-9a66-4d09-aecb-74bbe87211ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924778, "uuid": "483abcc0-bb6a-4f84-b126-1b7f8792627e", "value": "12288:KV59KLyRs8MSnAvH8MSnAvH8MSnAvH8MSnAvH8MSnAvH8MSnAvH8MSnAvH8MSnAl:KVXKW6U6U6U6U6U6U6U6U6U6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924778, "uuid": "f9ecd0e9-e0e9-41e2-abda-4b3a6b70085b", "value": 926544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924778, "uuid": "4593ba90-a9b8-414c-9219-9588398be64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924778, "uuid": "bee047aa-834e-49e6-b7cd-017de55d3309", "value": "3f8981f1a4160417e2859c31255e030de9e488eb032994cdc13681b091da1504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237ce3aa-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985622, "uuid": "5f370d80-f3ef-44f1-b823-ad5a396c60b1", "comment": "Malware payload", "value": "a46226d052a927f1b36bdebd6255dd2b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985622, "uuid": "894ab565-6652-47fa-b9be-3de3e127b28b", "comment": "Malware payload", "value": "40cf8d5cabb6458fa499749d468b227e002c145aa7acbb24ae371be9328ee7d5", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985622, "uuid": "03cbb683-c522-46fb-8903-637cd9227b8f", "comment": "Malware payload", "value": "037cedbf9312dcbe69cd52f384e8829ce823de1c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985622, "uuid": "6e77610e-775d-4027-8350-ce2aad0f3a57", "comment": "Malware payload", "value": "0346168bfeec20fb4b87eb1402b35997f6eac8ea8666dc6fc22b2f63fe8a62469dad27cfe69bbb913fa973e27623db9e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985622, "uuid": "96f9cc5e-5181-4618-b5cc-4c95b2ace535", "value": "T1853523119DA92D459F3C825D30774FACBB81CF82D8D86EBF6AEC29D7111A6C4902B50F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985622, "uuid": "6986496e-b007-4a01-b78f-5ec5845008da", "value": "24576:4wgBE2TK2KfBBqSDiGF5KBkBmHZGG67VRpuEXOaA:4u2KeXGrqMuoRDuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985622, "uuid": "c0f85de3-c83f-4aec-b63e-37293a505da8", "value": 1062087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985622, "uuid": "88119193-2baa-41da-8dcf-c4b12737bcf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985622, "uuid": "40f73781-88fb-4c82-948f-7cebe4aad239", "value": "potato.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f68b66a-3f01-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776940947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940947, "uuid": "54d92928-db11-42b9-ae31-859dfce20642", "comment": "Malware payload (VIPKeylogger)", "value": "e21c0328fc582f4e5a66e631e644e395", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940947, "uuid": "692a83e5-1162-4e0d-a89e-ad24661c47a3", "comment": "Malware payload (VIPKeylogger)", "value": "40d804b9813d3a6d40b7f33db2c2a09eeeff1b06413f2dfb06442176b4589b9f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940947, "uuid": "3ba89eaf-f5d0-4c24-bed3-31ebae0635b8", "comment": "Malware payload (VIPKeylogger)", "value": "61312f9bdaeb90d46d134126923340495d7c1619", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940947, "uuid": "f783faeb-0c7f-4dc1-9087-ef606dc81b8e", "comment": "Malware payload (VIPKeylogger)", "value": "43be152b6dbc9b40f0a0761b3e980fb9ff7336dfca40744e6a6c3ec2ec44e4bfbf31ae8cf0fa154a049a6f1a0277bb74", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940947, "uuid": "d6f03fcf-ecc6-43e4-b28c-04e76b0b4a31", "value": "T18BC312EE2D2949B16EC6C113AF8119AEE688F808890F3D0967F465A57F0F64151FB2D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940947, "uuid": "47149ae7-d79e-440f-9150-a56a5445e5ca", "value": "3072:UjoXRJPDJ717lrNZKKVYiMicFa3EHjCxiu+lZhgmWXXMxHZPOuZQWzCu2:UjoXRJPDF1ZNbMhSojCarhHWXchZWNW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776940947, "uuid": "9a1f2068-97b2-4b9b-8693-2528d5474119", "value": 122359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776940947, "uuid": "35c95117-36e5-4eb3-a4cc-4330c4b3eed3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940947, "uuid": "5cbf3cda-6f24-48bd-8b47-0f4bb54493fa", "value": "Trick.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd15e817-3f63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776983330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983330, "uuid": "f5359db0-ea1f-4ec8-b9ab-c28778ccc0b6", "comment": "Malware payload", "value": "7df147b14bf73b534cc62c5ff2a18ed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983330, "uuid": "29844bf9-1fc2-4df5-a819-77bb41f005aa", "comment": "Malware payload", "value": "4159fb1305a6c45f901aa0c5b8edf7192ca9f608acce445b0dc304edc040862c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983330, "uuid": "a3b9dec5-9326-40b0-8ded-700db0ee1e88", "comment": "Malware payload", "value": "7e5803a56d5c6e72f04f05a60c6ba5ca5e0aa295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983330, "uuid": "39aec5ec-677a-429c-981e-abf2e5200df5", "comment": "Malware payload", "value": "b8ace141889fdcaaa04d217860ba22e6ffffc31db3517f49c0ba24f1dc99bb733579ad21f08d6882327b8b72eb82ab89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983330, "uuid": "9e351e96-8fd9-4de6-858c-3b1adef0c2a2", "value": "T12F476B43E8A584E9C4AAE535C525A222BB717C894B3123DB2F60F7382F77BD05B79740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983330, "uuid": "f387e82e-3891-4bf8-99ed-70be900f7d66", "value": "196608:Q+kA6Wq2H2MSNJiHdSWIuxf1y/7X5lrJNGH+O+6xUa33BUKAmZN:Q+kA6X2H2IrbyjX55JNGeQxR33aK3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776983330, "uuid": "a25e962a-87dc-4d6f-a624-32976c7b0c1d", "value": 26394808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776983330, "uuid": "8f109c17-433f-4f49-a334-a45c7d886025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983330, "uuid": "27c73c42-117d-4f12-b85d-ef2b4003d7a1", "value": "vc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4a5cae-3f01-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776940939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940939, "uuid": "d7c08c25-ecc2-4dae-9469-d6665568211e", "comment": "Malware payload (SnakeKeylogger)", "value": "7adc39772786609118ae50a6d5e604c9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940939, "uuid": "f6a1735e-99d9-42bf-b3f3-75dcb991f288", "comment": "Malware payload (SnakeKeylogger)", "value": "419b24867a2cdba9a8587f577baf832b04ac4aa07c706afb97b50d98b1868644", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940939, "uuid": "bbcf3d61-d52d-409d-a74a-c121a46a7d3f", "comment": "Malware payload (SnakeKeylogger)", "value": "9cb931f43a1e5d395194899ac72ead6f8cf04ad6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940939, "uuid": "4deb85bf-73e9-4e4d-95f1-05bf5250ef4b", "comment": "Malware payload (SnakeKeylogger)", "value": "35e3745337ab3e2177e19ce2882dc7c049767ea552ef339e933554680b9a4c9203e99240e8c73868abb8dcf5e7889d53", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940939, "uuid": "cf526188-7deb-4054-9fcf-e784132ef34d", "value": "T1AC2423B49DEC0149D9EEDB6A308FB5968B85887FF01D18CF3647A5D9024F2014FBE066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940939, "uuid": "f7f30fcf-6d24-40b7-8119-422673aafc68", "value": "6144:c4jVr8XkG+p850AgfjhsuAH9KnwkYEdP8NRlJMJiE:jS+a50vauGjJEdUdez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776940939, "uuid": "ad52c2bb-321b-4757-ae44-c5ec061cef6e", "value": 223730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776940939, "uuid": "f6a7bdd3-4b00-49d3-94a1-5e21d65c0955", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940939, "uuid": "da9252e6-039c-4b52-9e11-3f74afdaba65", "value": "SILENCE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944203c-3f63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776983269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983269, "uuid": "6a5c6431-43fd-4d26-9bf2-f4f44bb3b5e9", "comment": "Malware payload", "value": "bd5273ebd19b5c5de76489a4fe445e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983269, "uuid": "c4605fc4-9dbf-4619-9436-59c8de3840bd", "comment": "Malware payload", "value": "424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983269, "uuid": "6fc28eec-16c0-4bf6-a3ae-8e7bbc51e966", "comment": "Malware payload", "value": "3eba2e09aee236c80c95cbdd7fb0d79fa910ac8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776983269, "uuid": "61a6ee8d-0e0b-46bf-b39e-207301d34004", "comment": "Malware payload", "value": "dbfbffc6edf72f4856f4860c1e5944573a55d0c7a6c56145769c3c5d042f21c8ebce7621b94d583d4fe3e46a4675d9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983269, "uuid": "6697db51-4d47-4dcc-a23b-90d5e78b5d2e", "value": "T18FA6330FCC65E80DB891301902B6477E47411C96FF4C5E2FF2E88D7AFA9A9757086E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983269, "uuid": "69a99c50-a0a1-4c7c-9839-9c05232bb049", "value": "196608:kIjQHtk0O7Jrd3AHhzMea1cVN2aFHXr0XtGeom6f2UvEmty5:bQS0AwBzNDVFHqdv0xvRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776983269, "uuid": "d39b8890-0632-4c24-8b4f-bec73dc99c0c", "value": 9687056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776983269, "uuid": "0f7ec1a2-069e-4992-a96b-52fa468d41e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776983269, "uuid": "c92a3e45-6cde-4546-a1d2-93ffd3583411", "value": "vc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa04b9c-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (SentinelRAT)", "timestamp": 1776912413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912413, "uuid": "7b90d0ae-22f7-45a5-95f6-448e43552a26", "comment": "Malware payload (SentinelRAT)", "value": "7fe9f680efb8660345b340df5c58e179", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912413, "uuid": "331e385a-35cf-431b-9c16-902880110c14", "comment": "Malware payload (SentinelRAT)", "value": "43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912413, "uuid": "fceb4d56-9543-46dd-af26-a3614756a144", "comment": "Malware payload (SentinelRAT)", "value": "4bbf34b61d35d5e60f19b61732950b91d5c4f22d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912413, "uuid": "542e8305-d1b2-47dc-8544-dd9f38d9e530", "comment": "Malware payload (SentinelRAT)", "value": "ec176ebc2d83323a73ad049c3f2973b7c7451c675aafaf1ce2528567eba836a5cd628a5e2f5ca886377850b76d6dcbd0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912413, "uuid": "a2b20f0d-c5cb-41a7-b066-86ec0c0e18e9", "value": "T1D2B3120A08A107B2EFCBE767728B787AD13100FE9184094F24A97D55DC4AFCE171A7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912413, "uuid": "124bddaa-4b4b-4991-a16f-cbe083b3f5e6", "value": "3072:AiVb8X/ncIoWGrC2qvi+J8fgc587P+XlE0:AiAnc5jWLKfg1La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912413, "uuid": "5ee66bfc-8d20-437c-84ff-8aadeaba3689", "value": 108275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912413, "uuid": "8a2a89f6-501f-45ef-ae4d-a454a4122048", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912413, "uuid": "562b26da-db52-48ff-87b1-bc5d60c66a2c", "value": "SIMPLY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a9415d-3f5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Ousaban)", "timestamp": 1776980440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980440, "uuid": "f0168b99-4092-46c6-830f-44df0030e788", "comment": "Malware payload (Ousaban)", "value": "7743cd9e0c1e631d5b5bda4de0842dda", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980440, "uuid": "5c4e495f-060d-428a-b6a3-20bc1607e783", "comment": "Malware payload (Ousaban)", "value": "43fee474ebb1abbf8d98fe2fcbd1f1ceff810f4f941a543407d39505d8a77347", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980440, "uuid": "7c0dbdb6-dd9d-4f25-9382-230abd36c23e", "comment": "Malware payload (Ousaban)", "value": "23fbed53c6db38211f4dd35bf47876b40c9ca6fe", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980440, "uuid": "5738b02a-b751-45a3-bfef-605d56475635", "comment": "Malware payload (Ousaban)", "value": "9fe07c548aa434a6eb0d8474250d78eeb8b26dee836e85537b326673f3e8f096f55d6534d3d59258208481fef26682a0", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980440, "uuid": "e20c9d11-d2cf-4e7b-9da9-edb12aef667c", "value": "T15A673325B1C75B65C1DCE0798F03B96CF2E1A90946704A6FFCA41FCAFCB52558AB1883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980440, "uuid": "28a42385-c489-4a82-b489-199d2a55416b", "value": "9a8cb66ff15b9e497838346fc1329159", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980440, "uuid": "4b80888f-aad4-470b-9716-03cde76e72e6", "value": "786432:Y0N/lNklutlj1OT1RtdhpWRpxCZ4pOEvt4ZUKFp6OEHW7ZSAodq:Y0N/lN3gtdf7ZsOEvJKFpVEHW4Ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776980440, "uuid": "7b10fb16-c2ea-405e-b7c3-bc627751a233", "value": 32442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776980440, "uuid": "4548b638-041c-4d2a-9f34-583b722830c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980440, "uuid": "1fd80376-b17e-4e0b-b1b9-72b0092ce290", "value": "ajID55WU.dll.part", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7051e7f0-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Ladvix)", "timestamp": 1776924333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924333, "uuid": "c5f844bb-e2aa-474c-a43e-4db9e098f2e7", "comment": "Malware payload (Ladvix)", "value": "641ce036a308dc4df7a63ccdb142e71f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924333, "uuid": "a2d28c3d-cdb4-41e8-984f-46c3d6b37476", "comment": "Malware payload (Ladvix)", "value": "455ab200b69db0f3d04203b7468eff43e328375510211400c2583e8063e6568a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924333, "uuid": "3ab0e3d6-3c2e-4cff-96a9-0484f208ed3b", "comment": "Malware payload (Ladvix)", "value": "82698410414f89976eab1c1353109aee3d1b94c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924333, "uuid": "c2d73fbe-561a-43aa-ae11-2c7e1ecab77a", "comment": "Malware payload (Ladvix)", "value": "7995c77be871590d0a7323ffd9d8960e9927c6b425032b2d96524037c1719cb45ada1c5f77fe77b1b9b2d52a9fa410dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924333, "uuid": "dbfd9092-0302-49d6-bf1a-a2f4d82e8f2f", "value": "T14CC2D80AB791CD3EC4CAC330589B867875B4A0F4EB2393273744777929427989F1E69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924333, "uuid": "2a638b21-3a63-4991-9563-ee02a789a278", "value": "192:RnxzjwsWskaDanX6JENuZYhz0h+fcfLBjDSc8CkjPnktjmEH/6Ru4HI2E2jMixV3:BWskamFsqGhR9jBkrkUw/eVEIV6uD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924333, "uuid": "0a9f10d4-afa1-4d02-bccf-a5d1ad861eeb", "value": 26391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924333, "uuid": "840f5184-e1e5-4d76-9fd5-c4cf0d63f53f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924333, "uuid": "df63f8cc-7062-4aa9-b047-c4469db598bc", "value": "triangle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990d253a-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776929555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929555, "uuid": "da7aad86-2cc7-427f-8735-e94bbbd2d64d", "comment": "Malware payload (ValleyRAT)", "value": "da13400dd477a997e88706ade4d65443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929555, "uuid": "177a0169-6814-4d39-b434-82afdb90a195", "comment": "Malware payload (ValleyRAT)", "value": "46160a20937f01430abf791fb644c32dc41832b236994c7d6d6370f0b1e1b730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929555, "uuid": "6fb6dfb6-1d7f-497c-9aab-83006b1eaed3", "comment": "Malware payload (ValleyRAT)", "value": "7ad90d4cffaeb02a089a9a1404ad5ff42b2f0aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929555, "uuid": "237165d7-06a8-49ff-bc83-7808b435baf9", "comment": "Malware payload (ValleyRAT)", "value": "f17914c9e2e26dd7f3f0ff859aa0d648fd66ac7917f2decf7d833ebf9120dab6b6bf7d6c8bbf1d68117d4270e94c2858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929555, "uuid": "0afea77f-6521-426f-80f7-c6e4a1cce52f", "value": "T110D5338B2BCB85B1C89610349E53399F27E8A04546BBCC396E839D85B463DD760CF727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929555, "uuid": "a8c62feb-230f-42a8-bed0-c06d0b077d7e", "value": "c12366bc928423da75a87d5e3461c7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929555, "uuid": "0e0d5fc0-f4ca-45fa-b9ee-cf3d5d8d55c3", "value": "49152:lFtcvcNWP7j+fxD0HU7MHkoEyie5U+Y70NZw/OfTCNaHWoOuY4dwsz:ljnOHkowe5dY70NZw/6QuYMZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929555, "uuid": "d62310b1-0d1d-427a-b23b-954899aad645", "value": 2940416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929555, "uuid": "9eb90b91-71d3-4e58-8bc4-99cf90e309b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929555, "uuid": "45ca7243-c7be-4c1d-abd5-b006a5133f25", "value": "DA13400DD477A997E88706ADE4D65443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6f2dad-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776944085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944085, "uuid": "5f8e94d3-8b17-491a-a08f-8505c07141a8", "comment": "Malware payload (Vidar)", "value": "1a73034d16fbcba5e28248b5dc1c4ef5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944085, "uuid": "c9750c02-6594-4e84-b710-b7633af7268f", "comment": "Malware payload (Vidar)", "value": "46c8b1e500d708d9ac0d4aa55a79058188f7e696b3cf3092378168f0d4b1be4c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944085, "uuid": "c4933e71-3390-40ae-9875-ba056f474fa4", "comment": "Malware payload (Vidar)", "value": "04659c8904ead4246a0c8d77dc871b6fa283d145", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944085, "uuid": "637c5520-7229-4741-8f7a-257ea0c6b703", "comment": "Malware payload (Vidar)", "value": "3566f810ce55ff40085777284c597ab763ab7416734bc01803a0f8dc887240e2d31f141ab36e18154760e802c83011e1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944085, "uuid": "e012ce35-2d8f-454d-bdca-d77c5252856f", "value": "T157958A87CAC11D87CEC51838AD7B5B745A71C8AAF812CA538B32A76D8FD7394CD1A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944085, "uuid": "61e34a6b-af79-4c1e-9855-73aac2c53985", "value": "24576:YYpBgUqv+REfHwl3Ntpd1R13s5l+4EKq5/ogsemfOBQKO1:Y6BgZvsEfHI3HLvds5JpawpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944085, "uuid": "583b02d4-e392-47fc-ba9e-c0d76213a865", "value": 1980814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944085, "uuid": "136f6ea0-2b72-46cb-9a03-e2aa50ab9122", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944085, "uuid": "024a4c38-b3db-4cf0-9d85-ba09f56df2ce", "value": "Set.Up.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d75e74-3ea8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776902807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776902807, "uuid": "09230a83-56dc-4f3a-8d5a-e4a840d1759f", "comment": "Malware payload", "value": "659f92fc5c4a81a6b05b384102a18f0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776902807, "uuid": "8c40a1a6-2531-4b18-81fc-b91ce58dac72", "comment": "Malware payload", "value": "46cd7521884a230230263916fb3cb5c65abe52d5be77cfb9ece6b6fab4229d74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776902807, "uuid": "76af0a08-a0c9-4a6f-8a11-85c67f4dcd66", "comment": "Malware payload", "value": "08a40bd12fe900dfff816a43d5a6e9e321c2bbf9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776902807, "uuid": "61eb49ec-6917-4280-8f6a-b9f454cb688f", "comment": "Malware payload", "value": "4683f3775824d7d847ca88827043331f269f1ca2f4544f90446945b1b9b17ce32be0b5df9d503da129dc48eac037281a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776902807, "uuid": "d16db22d-4db7-45a1-94d1-70604c865370", "value": "T1EA137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776902807, "uuid": "f69ca659-c01a-461d-b194-fc18e96f5ab4", "value": "768:bx+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bx+scy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776902807, "uuid": "94b4d2da-7edb-43f3-b0e4-85de23161835", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776902807, "uuid": "06022455-3e5a-4bda-b008-b441357055d2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776902807, "uuid": "83596e4c-8b43-4e6a-8b6f-d2a60e3f66b4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912f957e-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935125, "uuid": "13777352-5d42-43c1-bbe4-bbed8b99bd33", "comment": "Malware payload", "value": "816a6aab392e9980ed1079af73cfaff2", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935125, "uuid": "5fcb6b25-f698-4844-91e5-7889d6b10e3e", "comment": "Malware payload", "value": "476782f2fe39a4574c44e6957f8e5ca78d11e3d2d1751ab325f502f5345c848f", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935125, "uuid": "b01aee9e-86e5-40d2-b5d9-875286922d72", "comment": "Malware payload", "value": "a73676efada7b7d23087c341eceeb8598f0316e2", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935125, "uuid": "19958cb7-9779-4db1-aca5-392657a1abdf", "comment": "Malware payload", "value": "116b6c26d2a810402f13933de33e1c30f7d10e7d9120226f4e0dae34cc63f7bbaa533e6e063fe56751dda2fe72892d5a", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935125, "uuid": "2ff8b361-002b-457a-be90-196894ca0340", "value": "T17D92D08062F82714F576BF3B9A366E110837BD60EE72C75D5610DC1E39A5A10CD35F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935125, "uuid": "4ef84191-bd47-4bbd-b26c-e54aaa91c007", "value": "96:pRg6PYaT3bDA4PYaIK3iGAtWw+A4pYaP3CLb2Li:zgxur04gAyHj42Sy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935125, "uuid": "dbdb119a-bd66-4589-93b3-e52a413d94eb", "value": 19758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935125, "uuid": "a26eec70-16f1-4236-9535-c8a0af408d51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935125, "uuid": "90f4801f-3d67-459e-9006-edc421156ddd", "value": "Akt_neprybutkuvannya_boyeprypasiv.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8816d1-3ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776922634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922634, "uuid": "7f2f19a6-fd4c-4704-ba5f-be052a75f0d7", "comment": "Malware payload", "value": "dbe86b83eb3004616d7e054115620617", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922634, "uuid": "d1ccde0a-2330-4b83-836d-cd15a1deb9b5", "comment": "Malware payload", "value": "47b589605189793bba57129495dfa7367f79f9d6b366372386bb83ec991936a3", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922634, "uuid": "fe18b6dc-1432-4a8e-bb86-92f54e1594a1", "comment": "Malware payload", "value": "7e6215188a0a30ad8213fb4ec82b7fa96d29a75e", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922634, "uuid": "6beff519-b3e2-445e-8b58-18e658770efc", "comment": "Malware payload", "value": "1a0d395af7e5c0f01ce2100d742709ec48b5045125ca0507a70e9afdee24cf91eb36bf591b0e612bf945e0eb2ddf9d77", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922634, "uuid": "4e7ca288-5739-414a-8d68-94ac788fe203", "value": "T11F033C538C884E47E878C3AABF070F6C6F493E4EA4C276FF10260E867B716615C0E169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922634, "uuid": "ab2b3e05-2d69-4a7a-af95-28ac9267745e", "value": "384:+0svJd7lNK1osPjFLjhdlCxJPxncS45sJflFbfhfhfhfhfTZZZZZZZZzJGbyi+XI:FlpdCxJZnjWsh3bfhfhfhfhf5GVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776922634, "uuid": "9c3f890d-b665-4b94-a85e-58be5e5b7e05", "value": 38672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776922634, "uuid": "9fe06d55-6647-4448-ae49-08d88923febb", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922634, "uuid": "06f690a1-a42a-47da-89d6-f0146b185cbe", "value": "invoice-1645080830.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d00ca7-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976179, "uuid": "c6ea54fc-7f02-491f-8d8c-cfdf8104ab87", "comment": "Malware payload (Mirai)", "value": "67a060d0b20d312a7b3209810ea1402d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976179, "uuid": "11b21975-c354-41be-8ff5-68d367df1e9c", "comment": "Malware payload (Mirai)", "value": "4840d3a792ab95779658c2bf75271c471edb81a2887ebe4b9a81dc57ff3ea50c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976179, "uuid": "22a92dc3-5c0d-4040-9d44-cdf66e4caf24", "comment": "Malware payload (Mirai)", "value": "c60c8261c9d8019d93e2ef627dec2cf069b5c68f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976179, "uuid": "009e3216-d203-4fd8-9c79-6e76c22497fa", "comment": "Malware payload (Mirai)", "value": "c6254f3fb52fc7209a68b6059327dc2d01bd84779e89294f1debe2941ee80aa733f642fd9c741ce446fe607631dcdbb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976179, "uuid": "b1f88a1f-1ff4-4b24-a7a7-b023673ba931", "value": "T187533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F413BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976179, "uuid": "c4d44e59-a99e-4e50-981e-597359a7baa4", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyQgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyQgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976179, "uuid": "ea9e4d76-363e-44c5-ad34-c1b1acbb6f65", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976179, "uuid": "499a108f-022e-4388-a609-16573b955649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976179, "uuid": "ae0127ab-6718-423d-bb50-3516f7ab511e", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc91f34-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923151, "uuid": "2e0dbf4e-8d79-4af8-aa21-08f5871d6f83", "comment": "Malware payload (Mirai)", "value": "ce9c116f2fba02a18926ed4dcb241c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923151, "uuid": "d23b61c0-5cd8-42d8-87e8-f74666fc3983", "comment": "Malware payload (Mirai)", "value": "486d6a6ea06b50c6ea7609458a8c2795c1ebcf824606e85ffc93320a61090669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923151, "uuid": "9a29a780-34ba-4e0c-a63e-8d0b9a7417cd", "comment": "Malware payload (Mirai)", "value": "b84ac44b02c4a1e5e3cb6219c19c921d216490e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923151, "uuid": "6804fd21-0558-4180-8c88-9325a51d9a29", "comment": "Malware payload (Mirai)", "value": "7e9f73b9b40554ee45bdff2ce7c6bfaed49203a58036ec083b3ae5a81d07e7433109e49a1ddf4c2886265d816b1b825f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923151, "uuid": "200d22b2-c81d-4eb2-a824-19330a8ed8f9", "value": "T157055B0AEF941FEBC4EFCE35891E830705ED958306C2A634A1BCC95CFA8D65A4BC7558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923151, "uuid": "652be6ea-ca34-4286-931a-fc526d5120c7", "value": "24576:eOwIIM7P6ktUfXq3TfSc+H1azPrSTr70M8:diM7Yq3fGdTr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923151, "uuid": "72596c43-a421-425b-8623-be439287593c", "value": 860516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923151, "uuid": "5b2c046d-092d-4c5c-8431-dcc5ebfccbd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923151, "uuid": "60e016f9-1811-4829-bfc5-62435be80867", "value": "svc.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca62f534-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776927920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927920, "uuid": "1a974b5b-9884-47d4-a4cf-d175135cdeee", "comment": "Malware payload (Phorpiex)", "value": "66656bc4b3115486bcd4979dced90e45", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927920, "uuid": "40341f74-67ec-4b3e-af29-ec549547c3ec", "comment": "Malware payload (Phorpiex)", "value": "4910c586d5405fe9ca9c339ac2e3904f6eff8b8913605606fcc54f14810a29d4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927920, "uuid": "db266845-7710-4c7d-a809-ad4e51e7cb87", "comment": "Malware payload (Phorpiex)", "value": "ae5a28b4990b1e4da1e087fa5c793a13c24f830d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927920, "uuid": "616abd10-0ac7-451e-828a-0a435410bc39", "comment": "Malware payload (Phorpiex)", "value": "027b7abd654e03393f56a4fbf5cf7303ec29a82fc0fcdaca84efc0679b3eed88bad8292ecbbf9a44ebd6bd6584efff22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927920, "uuid": "58634b22-6aeb-4404-a383-a549e2b894da", "value": "T18C824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927920, "uuid": "75269d96-737e-4446-b627-ffa373a5c41d", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927920, "uuid": "569841ca-8a8f-4a01-9034-1ad04391dbd8", "value": "384:iI78VGQic1Kwvw077u9NHu/gBhav8U9cd:HAE0769Zha0Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927920, "uuid": "bf436652-2a51-49d6-92e0-d6ce56fcb23c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927920, "uuid": "5619bbb4-c0f2-4244-913d-b5f6e7af87cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927920, "uuid": "96561bf6-0ad2-4fd2-ad52-3168bf67cbd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909a84d5-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954022, "uuid": "0f32ae82-dc6b-4e2d-9fe4-6cfd97e15de6", "comment": "Malware payload", "value": "1097e6cabf1ca8018e66ecfe47fa1c3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954022, "uuid": "e15d42a4-35ff-4b81-bbc6-4d049a23aab1", "comment": "Malware payload", "value": "4b1a581a580c24d9301e920c5b294247e491e244dd7df3954303487cd365da0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954022, "uuid": "5a64b1e8-9224-495c-808a-ee601d9d1dee", "comment": "Malware payload", "value": "c794a0bc4462673135a927f94c7866dafbb09da6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954022, "uuid": "889323e5-f166-4958-bc63-4107b561bf7c", "comment": "Malware payload", "value": "fab469a73f2c2ed071197d8b3b9e4db714e1b4a3b310a98a5649ebc012e9dd95a8527ea8e397eb0590f9ca6815fb41fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954022, "uuid": "33b35b17-1621-4fb9-8be0-2ecc41c7a8df", "value": "T1CCF58C15B3805AB8C11ADD3DC6179E32C1B2B8220776BD8B5AD5D7CE1E72FBC4A39601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954022, "uuid": "0e3feb44-87aa-4ea3-a20d-c70dffb5d474", "value": "3038c4f73801d48a3143c75a9cdbfa28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954022, "uuid": "336360f6-c438-4983-bea4-cf9d16b80942", "value": "49152:77m03Ki7h3ReyMvWvvvvvmmwEzRQvv6c1Fs8hZZP3tAXqImmwgjbSUKA+eALJY:gi6RVFfZP3tAXqImmwgjbSUKA+eALJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954022, "uuid": "83207e3d-fee8-4a57-a671-6cb41aa5d9b3", "value": 3535360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954022, "uuid": "2d296a17-d335-4814-83f4-8331949b0354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954022, "uuid": "56250444-a321-4510-afa1-e471e6356534", "value": "SspiCli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2077ad58-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982181, "uuid": "f703c2de-d7b3-4102-b8ec-e8176b0b51bc", "comment": "Malware payload (Mirai)", "value": "6bcbd0594d44520cb81194ee501dc7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982181, "uuid": "0af49fae-36ae-4a55-a7d2-8470fbd023b3", "comment": "Malware payload (Mirai)", "value": "4c7f9344cc2b2932fd52f27f474d309eb857bece6e792460c2419155217bd0f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982181, "uuid": "395d69a6-6735-4404-ab78-d4c281cab560", "comment": "Malware payload (Mirai)", "value": "e5424e8d3aaad32df62203fc54bb59ac6b05d475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982181, "uuid": "52798b9d-c6ef-414d-a9d0-130d19cab1b6", "comment": "Malware payload (Mirai)", "value": "fea771d61d0a34d5e838cd8dd0a3e364ad24947ebe29a3b3decde46259010fd80efba9b9e3012e78ee50883735eb24f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982181, "uuid": "c0efbf72-7c5f-4610-863b-74b6d8e69745", "value": "T1A6C30855FC414B53C6C212B7FB4E438D3B2A17A8E3EE720399256F61378B95B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982181, "uuid": "3da3db37-2e5f-421a-a922-1e1b791bfcea", "value": "1536:4QVhx/9YIpH08Y1kA1Dg4VxogTVP7b7+O/vjpCh5D9l4nwywMFsf749XFlGWdOTM:4QjpUt1kZ4ggRP7b7J7pCjliL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982181, "uuid": "5a419be6-b1b7-4121-b6cb-082829790ffa", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982181, "uuid": "a65224cb-757a-4581-997a-e39b4899e833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982181, "uuid": "f04b53d2-663e-4a12-a6ea-cb35bf34eff0", "value": "concakhbtandhuy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d5375f-3f39-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776964987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964987, "uuid": "8a08857d-8261-4f86-a9d2-1561dc5f8d47", "comment": "Malware payload (CoinMiner)", "value": "e06809a5de1874a3e0ccc79328cf74a7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964987, "uuid": "61322370-f3be-402c-b363-672919fdde78", "comment": "Malware payload (CoinMiner)", "value": "4c89994c87b6b46b03c12b77c1e3c2fafdf05395d6d56d7b719f69516db33ebe", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964987, "uuid": "3119e5e6-f541-4f64-a174-1790855eb2eb", "comment": "Malware payload (CoinMiner)", "value": "bfe49eeac249f8e7259b997e117c464638e0f764", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964987, "uuid": "0f282809-b9c5-4a71-a7f0-2ae354637627", "comment": "Malware payload (CoinMiner)", "value": "1e31afc355bb47739d4f8f2d8dc25f8331c643e2ab9f8067e874f2f83e4392d4898bd02e17f2a016a8a2a5fbe96a9a2b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964987, "uuid": "d49b5860-f922-4933-a429-04358ca3d84e", "value": "T12FB39E05F3E201F7F6E2093100A6726F9B3662249720ADEBC75C2D529913AD5A73D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964987, "uuid": "03934942-5793-4aa6-b2ff-8cd61d0253c5", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964987, "uuid": "aea77696-4e23-4050-ad77-f9b9ed10d97c", "value": "3072:n7DhdC6kzWypvaQ0FxyNTBflDhO5yuGN4:nBlkZvaF4NTB9DM5yuG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964987, "uuid": "224bf91d-4cb3-46a1-bdcf-aa4d3c1274a7", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964987, "uuid": "bfcca9a3-3289-4b68-82ec-5fc1a69ea9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964987, "uuid": "4e511455-7715-4a97-b3de-b6caa95b60c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec78511-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776968622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968622, "uuid": "d3db515e-98b3-4357-a576-d96c14af7e60", "comment": "Malware payload (Mirai)", "value": "51fcb6473c822ef88f6c6e37dcb95524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968622, "uuid": "f712597b-ef7c-47b7-bdec-5f6df7a8b77d", "comment": "Malware payload (Mirai)", "value": "4c8fa36ee0707027b72794fbc3831c3bef22e81dc91a162895c27595ef2afaeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968622, "uuid": "bb83c476-2a36-4af4-8745-bda32b67b2d9", "comment": "Malware payload (Mirai)", "value": "d34aaeda8bec6aa44c0b0c14c33f556c4c99afb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968622, "uuid": "cd20ca96-6c30-4dbe-9108-56f3b99ae202", "comment": "Malware payload (Mirai)", "value": "c8276e354d98831e2fa78d27c32a9bfd965aafbaefda741a5dc38ce6cd83d030cce427d81c09823fa45a34b8c9cbf956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968622, "uuid": "ce73603e-ee68-4959-93bb-87013f7b49e4", "value": "T162246272985CC587C122627DA0EECF7ADDBE72CA2618CD01BCD118399AD5FDA3907D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968622, "uuid": "e6873437-825e-484d-9728-7bd4d88e1f34", "value": "6144:cryCkdErLtPeyXyEkVi8PJk5Mbm2pGPe0mojvAaOiHs5Y0JQO/5x+HsXTP7Ra:cryCkdEmx+MZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968622, "uuid": "451334b8-f6a2-4329-a584-4766d2e6aca0", "value": 220164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968622, "uuid": "55e4e6b2-1bae-4f05-b01c-52d3a6978e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968622, "uuid": "a7cae6a3-a6df-4381-b0e0-39247dbff621", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dbfa11-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776938007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938007, "uuid": "23d6a712-557b-485b-add3-41f44b1d6d8b", "comment": "Malware payload (a310Logger)", "value": "03493db6947ccb5fbdcc4302ed61a11f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938007, "uuid": "0af6be34-655b-4903-ac3c-f69e9732244c", "comment": "Malware payload (a310Logger)", "value": "4cbc79702cdc46953a14237c27ab6a81c8e46895acff1119a93a9912b4281065", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938007, "uuid": "22bd2da0-5b85-4135-94a3-e0ef83c104a6", "comment": "Malware payload (a310Logger)", "value": "c584ac411c607b275c9804adab3ad93681993608", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938007, "uuid": "067af9cc-15c9-4a33-b8fa-417128e2170b", "comment": "Malware payload (a310Logger)", "value": "22eeff34a42804c439c0000f50505dfda33e35acd81980486326f8a5867b5fa118e33e2442434c94708c28be2a7c0185", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938007, "uuid": "544690ef-7746-4c56-9b98-62d858221ba7", "value": "T1CB3523E09B88FA83D45627B11D73E3341261AE5DD520C302CBDEEDFFB9067A1B669241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938007, "uuid": "85c76fec-90d0-42df-9332-96cb36a9cb67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938007, "uuid": "14c5ae38-8d15-40a7-a4ba-89d2ac489766", "value": "24576:d5wJ2h9Urvgwy+eQw657+jp8edre2SXp1d+qJLT3JU0BByj31Xaw0:0wmvl51Gp84rsZ1d+gLT3jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938007, "uuid": "2ead86ad-6664-469d-9a7c-abfa3fa5b72a", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938007, "uuid": "1cc85470-f045-4b82-9da9-3624e05164ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938007, "uuid": "9622c1e4-7bbf-40b4-9317-597ae91680fd", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0124bbf9-3f58-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776978263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776978263, "uuid": "1f415378-db77-4288-86a2-c80d9ad77f9a", "comment": "Malware payload", "value": "97cccfe467182860c09040566a480ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776978263, "uuid": "446274b2-7c31-40e5-abfc-bc5cceb82303", "comment": "Malware payload", "value": "4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776978263, "uuid": "d363f930-5001-4d73-a121-7d432523b350", "comment": "Malware payload", "value": "fd122692eabd9e2d6b49e94b89e33dcd8191bc9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776978263, "uuid": "974fef93-c266-46c3-a197-f6bf9a6a4a9b", "comment": "Malware payload", "value": "173436992809435e980c3cad772da56b1e174ed75b1894a7b361376383cf91c8c2055b6311fb20a3b9606cdb1aea7135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776978263, "uuid": "e141d9b7-547c-4bd1-ad73-c695c9dc7b77", "value": "T1B5C44A03E1B295A8E52AC078462D7237F5367C4C4734AAF7CFD09A292663BD0677BB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776978263, "uuid": "d89fe988-e23d-4558-8979-f13662151a2c", "value": "498288e4a0f540ccb54fd7854f453353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776978263, "uuid": "cd821129-01d7-4f96-a315-6120c96b8563", "value": "6144:4ByhBgJeu5j7ArXT3aY0ben3gRL9abdxl0KN0uqviZ0Q4uhzkaJLE2w7FTxsaErq:wKg0u5jUT3H0taJLE2w7Fq/XCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776978263, "uuid": "db6d311e-447c-40d5-b552-5e0a3194df5f", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776978263, "uuid": "ddefe4b9-2c68-46f4-a9da-eb3603fd99c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776978263, "uuid": "37efc846-350b-424b-97b4-b742439623a6", "value": "win.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea2be0a-3eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776909378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909378, "uuid": "574a4112-0f73-4c49-8fa1-ca5dff8ebc02", "comment": "Malware payload", "value": "aea0599ab3149ea7317baffab651425f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909378, "uuid": "1b9b6789-78e2-4d08-a7a1-4e395c2498cd", "comment": "Malware payload", "value": "4f0513852f8c2305c06a91113e5fef54809da4626cc9f1c68fcb01ac27429b00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909378, "uuid": "12121184-0f9a-4d00-abfb-d77c6c9b0ecd", "comment": "Malware payload", "value": "3b6ead34118f9da67d5bb48abd6d17870e5a0c7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776909378, "uuid": "8a11c2b6-da14-45f6-bdaf-8c8f0a0c0e2a", "comment": "Malware payload", "value": "54ac969975df5a5bce8189c090fbe5f4e0ca07abd1f2cb54a0ae859a5fe6cfc576fffdf70a28caa001c454b8bd55a060", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909378, "uuid": "aaa86ebe-6375-462f-9543-8243ff4e3bc6", "value": "T1BD716605EBE4416BE07B0734AEB3430797B0F8848FB34B2D05905359BC616A44DB5FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909378, "uuid": "84c07baa-6cc9-4a20-91fc-fdc7f68e8abe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909378, "uuid": "30acfac1-e8ae-4be3-82fc-5412f3c6773f", "value": "24:etGSR9OAzEO3Dpo+2v/OffeZP9+C76JMTNtkZfB95moxFDst2WI+ycuZhNpakSX8:6xI2gIJD5m0k91ulpa3Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776909378, "uuid": "6c9f670b-64ec-44db-90ef-6bfbb496d1ba", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776909378, "uuid": "2bcb99a1-92c5-4dec-a9a2-060c02d468fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776909378, "uuid": "a69f94d7-4747-43fa-addf-8a997ba62e50", "value": "h5nct3oc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4ad60e-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955867, "uuid": "03b3d3bc-ffbb-409a-b51e-d27efa328ff9", "comment": "Malware payload", "value": "1e2c2e391ada8b9fbbb827dd9219d5bd", "object_relation": "md5", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955867, "uuid": "8f87d9ad-39f6-4598-af59-4e3bdaba9394", "comment": "Malware payload", "value": "4f288e33f1864326160f56e7cc8ff3c19a6f12a4526a90333e3332861ceb5f6b", "object_relation": "sha256", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955867, "uuid": "3dc71a0b-0c90-4f8d-89ec-b876fa8bb88a", "comment": "Malware payload", "value": "c02cdacffd89e851e59c37967ac1f858c3da2a63", "object_relation": "sha1", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955867, "uuid": "cae4272e-f1de-4c4a-b546-8fd134436207", "comment": "Malware payload", "value": "28bf68d3e266208bb60e2cb3b932fb133bb0f06075de792759dee4c734cc8e7f6338aa626d1a820987f48aa2e9ec9ca5", "object_relation": "sha3-384", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955867, "uuid": "578a6c4d-6f1f-43ee-bcfa-883851741967", "value": "T1EC51ED99AB262D30B95C047CE85A612524824F2302BD3E9075EFA5289F1DB4FE373D73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955867, "uuid": "1db11135-242b-4d05-b30c-28eaadeedcf4", "value": "48:KlPFMt1E3KKwyQ4B53hwNwrmJSPCYQAsqjm39zFYgAwAY5:Kl9Mt1E6Hy5gSPCYp9jmNzFfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955867, "uuid": "409c3643-b348-4147-87b5-47117b3e5da8", "value": 2469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955867, "uuid": "fbf645d3-aabd-437d-88eb-0ccec3219280", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955867, "uuid": "a78c90c5-63b6-4b86-b21e-4a99657a5e31", "value": "4f288e33f1864326160f56e7cc8ff3c19a6f12a4526a90333e3332861ceb5f6b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30823485-3eb9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776910052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910052, "uuid": "4e885134-56ca-40d2-a92c-cb278763c15c", "comment": "Malware payload (XWorm)", "value": "202a45a94c6484ea89330c2075842933", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910052, "uuid": "338fdca3-d9f8-42a4-9a52-bb93ea92c18b", "comment": "Malware payload (XWorm)", "value": "4f3ac17ca2c10d5129d7001d855b7ac073abccde991424cb2962a48ed3e8bb0b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910052, "uuid": "042e7539-57de-4c89-8265-ce65c4809da1", "comment": "Malware payload (XWorm)", "value": "f9a9f87ae46e1df10176caaa5e75a452f3226036", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910052, "uuid": "a0c70827-3f0a-424b-ba59-1b7aca474be8", "comment": "Malware payload (XWorm)", "value": "cdbd6f963241ac64b70edcfd82e01d8030440c9c67b0a2b013712285ac30121c7c69c1dbcbe626cea6c6aa13e4d637c3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910052, "uuid": "6abdb3f0-56bc-4533-ac87-6d3c993dcc7c", "value": "T10563F1404F8187EC3F4BDFFAB0A7E2CDC597A127904B9D2837A06E456B07A44972E94D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910052, "uuid": "f34b55b8-b849-4e6b-b8bb-25b3132da1ef", "value": "1536:JPr6XkoDSgpUaenoda9rbgB8dRt3JWAylhX+mlf9nG:dYkoJpUaeo49PgCrBYlxHlf9nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776910052, "uuid": "06cdfb69-2c08-4735-b514-c67337e554ff", "value": 72908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776910052, "uuid": "b84a9fb8-4934-4126-b477-adc84bca8ebd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910052, "uuid": "0a40d249-ac11-4b01-a7cc-ae439e832343", "value": "perfect.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62d8591-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776912397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912397, "uuid": "6fb8db36-44d5-4d19-8253-ac525f13dff2", "comment": "Malware payload (PhantomStealer)", "value": "f5612d481fc9e8c4a2b7ee7eb70c4dbb", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912397, "uuid": "f16c1105-ddf8-4d62-8891-32895c4de268", "comment": "Malware payload (PhantomStealer)", "value": "4f7d170b16f656a4bd09f5e1b8606eab8b8a5381a1230e2a716a01cc837c73f6", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912397, "uuid": "e1859fef-4e1e-4143-b6f0-bc3e799813d3", "comment": "Malware payload (PhantomStealer)", "value": "9fbc359d8cf4d07c86c3b809d01c4c4d7802b639", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912397, "uuid": "b65a0f92-2049-4239-ac01-bdcf5bededf0", "comment": "Malware payload (PhantomStealer)", "value": "c0a7e03460c589412bfbc6cf55ad3b0a48cec814c16ea140c52255b7ffbf518ae33ef99eaf43ed6dcdaa81130df444a1", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912397, "uuid": "f119df94-e143-4f93-8481-32ef11667dbe", "value": "T1C72523508C082D7E476C8318783F3B7BEF66A751B44A978E95ECF86A213DB507A4352C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912397, "uuid": "733beb2d-f6b4-4c55-9993-8f40414882f9", "value": "24576:rD0/VEeDQaxRbYV+aBJsIpjW+yaZYxb/NYdHpFWDoGeW:grlaBjQXyWopk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912397, "uuid": "360aa6a4-a0d8-420e-b5c8-014cd7262497", "value": 1044963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912397, "uuid": "c996f612-cc63-42c3-ab44-e5e511fb53a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912397, "uuid": "5e2c1286-ab76-49b7-a372-032cf569a72a", "value": "rail.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef74dec0-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927982, "uuid": "5fc8fe22-f90f-4a47-885a-263e81464344", "comment": "Malware payload", "value": "a1cfce078435ca376462ab933b162021", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927982, "uuid": "4e2e40f5-55dc-47b7-a981-22e321acfac4", "comment": "Malware payload", "value": "4fd0fa7046b696f48be969e7426e9c93851451db07737b1b76f6bd80a51f9ff9", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927982, "uuid": "895dca05-c219-4032-84de-b0dffb5e4b45", "comment": "Malware payload", "value": "3ddaddc6fb1676c13d49239394473fbd5ae7d9e7", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927982, "uuid": "bb4091ce-94c0-4fa0-a45f-e8f143b1ff11", "comment": "Malware payload", "value": "c21184ca709776314d21f2cf7f0b5969a7d3194dcbc4777ce0970fb080509babf28bc9c43a5cd84a90f17c174466c550", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927982, "uuid": "1b15925f-bcff-4f65-a8e8-57cf375b2f18", "value": "T1FE372319897D4F3E8BBC30BDFC292DE741088E70412CB7A66B5C25DB255B66420DE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927982, "uuid": "6907b502-4ca0-457c-a35b-1d69c48ad7b2", "value": "49152:j+zze+zz9+zzL+zz++zzi+zz4+zzY+zzl+zzJ+zza+zzb+zzrxh+zza+zzs+zzDD:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927982, "uuid": "8c0e8272-15e5-4442-9fb7-70beb5728564", "value": 22571559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927982, "uuid": "dce01746-41f5-4418-9da3-c7a2cecf7827", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927982, "uuid": "9c38a93f-e3ad-4c51-bb07-edbd9550197e", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e4a101-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925366, "uuid": "b959969e-1b04-4a60-a74f-1d117aab6f57", "comment": "Malware payload", "value": "377024b8d30f4b20e69884106d67f898", "object_relation": "md5", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925366, "uuid": "50fec9f8-6b8e-4e3a-9384-267501ce871d", "comment": "Malware payload", "value": "4fdfd9a75bf50be3f22d992ca0735621151c147540f4a8f4e676221fc099e141", "object_relation": "sha256", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925366, "uuid": "362f46ad-13bd-4f86-906c-b0f734c72a83", "comment": "Malware payload", "value": "87aa932e17a72354d0a64a677022062d7f9dd0d8", "object_relation": "sha1", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925366, "uuid": "8d111635-f25b-4fab-ad9e-8f5f941c4515", "comment": "Malware payload", "value": "f13a21631a282d74e5eb618a0536b481b9af67a967f183cd7c8f5236ee1925a933af1ecfecf8bbd84b647807176185aa", "object_relation": "sha3-384", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925366, "uuid": "fce208a2-8729-4686-9dea-8efd41ff1803", "value": "T12E224B5B6D53ECF913B3BBD0DDBA10B8DC1A58A648DA8404082BB7708528FD91E425F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925366, "uuid": "855df477-0405-44f0-a923-0388cfe194be", "value": "192:8NQBv6CGn+H5224LjBGM5gDetAcFSBGM7fMiazLqqTOyy2ztv0LAflzCy/UkFHS9:iUvI+H02EsLDetAcFSB5MiazLqEy2zlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925366, "uuid": "b26f4840-d3ba-4e77-94f9-5e04db8e4516", "value": 10724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925366, "uuid": "2d4d9107-bcb4-4cfc-a2f1-21c6773bcc36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925366, "uuid": "527c94f8-e8fe-4dfe-8284-235c463ed2a4", "value": "4fdfd9a75bf50be3f22d992ca0735621151c147540f4a8f4e676221fc099e141.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab1d64d-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982198, "uuid": "2058a513-f7a1-4280-9a1d-ff4ad6e1cd63", "comment": "Malware payload (Mirai)", "value": "9eb68dd06527ab24eb93744ece63a90f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982198, "uuid": "857bfaba-617e-41c8-ae31-db24b5a71e65", "comment": "Malware payload (Mirai)", "value": "4fe0aae75c6275ff912aa595a2222776f8a803413b761b9c24de20ab76887529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982198, "uuid": "dc098881-5d3c-48c0-9077-09822794f1e9", "comment": "Malware payload (Mirai)", "value": "fc419c12a92bb0565ee524952d1f4c9fef70700e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982198, "uuid": "b5121166-fcfb-405b-8c60-19383075b6d1", "comment": "Malware payload (Mirai)", "value": "ef9d4ce4d510221f4efefce8e908f23fedcf4e860c23a8d52dd6ef1b118bedabcff5d31d2cdaadeb5fb0dfb1001359cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982198, "uuid": "6a4bf5e9-2398-4eaa-b3c4-a5cc50031319", "value": "T1CDE308D7F800DEFAF80AE33748530905B130BBE145925A373297757AED3A1991867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982198, "uuid": "b4959f7a-389e-43b8-a8d4-9af41e4dba8d", "value": "3072:QFaUxSQpRDtx55WXuSNsm0QHS0hIATlam/0VrjbiULITViMyRxodp:6a1y0qAEm/cLITNyRCdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982198, "uuid": "0b49b9f6-dae6-49e1-a3c6-5984e2324826", "value": 146080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982198, "uuid": "2be07123-f3e3-47e7-bc8e-b653d1b0d7be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982198, "uuid": "3629af5a-126c-4539-9639-7d71e5b0746b", "value": "concakhbtandhuy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d0833-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776927723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927723, "uuid": "abb6fe00-2381-4e28-827f-c8fe845958cc", "comment": "Malware payload (Phorpiex)", "value": "57d6c30d3024bdcbaaa7d4bd8a294f42", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927723, "uuid": "bc3b779e-6c95-4f04-bdb2-e8eb43d1eeb8", "comment": "Malware payload (Phorpiex)", "value": "4fe8620b653acea285b9dd46840140605054804eaa56941c5ef8a3c3bb37df1e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927723, "uuid": "adca04d0-ebca-4f56-8c0a-af5844e160c7", "comment": "Malware payload (Phorpiex)", "value": "a68a268fee1a41c060b5387f638a171b8a1f8936", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927723, "uuid": "0e26764c-bfe0-4260-89a3-ab4e598b714d", "comment": "Malware payload (Phorpiex)", "value": "2aade4fc19c6a9cfccc0c037e223d8f8e06ff0a49deb67592594317b47d39be4f9e86c73d83f5f23216f308cfb7eb0b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927723, "uuid": "cb82debe-223a-4eaf-a816-8aa32e9682e6", "value": "T12E824B0FB9424216D0D100749676867BD979A8B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927723, "uuid": "7b578a95-5d04-4035-8b97-71c750e90f97", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927723, "uuid": "c83161ec-952d-4fb7-969e-af02e7f7e4cb", "value": "384:jI78VGQic1Kwzw077u9NHu/gBhav8U9ca:wAo0769Zha0U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927723, "uuid": "909f5ae3-2f9e-453e-9a3c-8573a50dda0b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927723, "uuid": "79203854-96d2-41fc-b17d-d02132f6b203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927723, "uuid": "f7087523-67bf-4aed-ab6e-79712ed50470", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ba506b-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776928575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928575, "uuid": "24f35f7b-e3e0-44b6-ac16-b945716f0445", "comment": "Malware payload (Phorpiex)", "value": "46c1a9d077fd8fc1584052a95b02afb3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928575, "uuid": "a8dc153f-2e5d-48de-b73b-8f34fe85b56a", "comment": "Malware payload (Phorpiex)", "value": "501b05b797f03678aae8b3e3598115e9e2aafc6c6198a548d8a447fcd82137b5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928575, "uuid": "a1e4c4ec-fa59-4748-a5cc-0cfe56cd3ca7", "comment": "Malware payload (Phorpiex)", "value": "2f2dda184413852251a2217d34c1e765ff4594f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928575, "uuid": "6feb1541-deb2-49b1-b622-96247b9ad96f", "comment": "Malware payload (Phorpiex)", "value": "fe00973e44e2f65eb7b867319a51ed9540a1f1d8f3b2d5213b56fd873e2ad513fc53b24212da8f93592e6ccf59fcfa7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928575, "uuid": "b2da9d33-1223-45e7-a112-c89bfda1c3ee", "value": "T147824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928575, "uuid": "290bd695-26d9-43e9-ba8d-639f340489b5", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928575, "uuid": "c3be0919-fd42-4186-95aa-b4f7889f7d8d", "value": "384:YI78VGQic1Kwrw077u9NHuagBhav8U9cf:JAw0769uha0U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928575, "uuid": "1bb14c60-7acb-46e3-af52-da17b7a54cd4", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928575, "uuid": "33719add-82ab-46fc-a0e0-33d7c1318b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928575, "uuid": "df733eeb-4aa8-4570-9fbc-1c03462cc738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22632d85-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934081, "uuid": "1531164f-edf6-4592-9ecf-9115767484ae", "comment": "Malware payload", "value": "39d6583973c4ea786604d3d561b3c41d", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934081, "uuid": "9c637585-6e33-48c3-ba1b-6f0a9e1716b0", "comment": "Malware payload", "value": "5071921cb1ca369fe8f7af522a00373c8c85e4357f7ea1879d2cb4ae791797d6", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934081, "uuid": "ee1b095f-76ed-44e1-b4b7-bd683726b837", "comment": "Malware payload", "value": "649b251aae380d33fe2e0e979d86b1f783c8457e", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934081, "uuid": "66f2a975-5451-4d1a-9742-54363a6a03ca", "comment": "Malware payload", "value": "aff0fa019316af352dba859d07fd0d731fbbdf415fdd6de05039361f4ad7a03d25ed4e28cc1c740f318bb2947f03a2e8", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934081, "uuid": "db2f4345-2d17-4d5e-a1a0-a771c598e0d5", "value": "T10BC08055681EC5C43A5DB1DDE2D1A8D1C83705031511D8527FCBDCC55C4530D93123CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934081, "uuid": "47eb0690-c960-447d-bc4c-167c9df1938f", "value": "3:k8PiFUSXHPtp5/FERMQ+OX8PRzxAgWSJJHJFEiTyWNcGKIF7OJAJCKWqL3dAKCAT:kNhtWXuflEiTF9K4iqrCZ0Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934081, "uuid": "d3a5f98a-4fcd-4bad-a31d-c1b37d27ac56", "value": 180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934081, "uuid": "30b13076-64e3-4029-aaed-279379099bdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934081, "uuid": "6b5e273e-bc91-4db7-9b75-0b2d2898e44f", "value": "install.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a43db1-3ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776933787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933787, "uuid": "0d7c7585-bd53-489f-8b65-9670057d267c", "comment": "Malware payload", "value": "b27ebd7b8dd87f2572821fb751ff0720", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933787, "uuid": "1ec8a7ad-1ccb-4f37-b1b8-4875625c8ffa", "comment": "Malware payload", "value": "50ed8dcf6861c17f18bdd84c5435136785b0b52161ff032a448bb5c418e6f9a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933787, "uuid": "ffcb2bee-3438-4558-bdf8-248a98f4f6b5", "comment": "Malware payload", "value": "37030b0768684df308b129def3b87246e1985f08", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933787, "uuid": "73fad242-133c-431e-b355-2fee09d8672a", "comment": "Malware payload", "value": "b13b8aa1f498505a84c899ec6036540780cc7afc00b7850615ab7df7fe586a510d814f918a1f0cee5ca0a75dc6f0b4af", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933787, "uuid": "b05d9a00-5a99-4b6e-aaf5-935f40257287", "value": "T1F131BADC3CA34873C86783FC7E5AC45B0129AEC921F3A17F6668A6002421D8B2366554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933787, "uuid": "88354168-e2ff-48b5-a57e-fb1a6e3ab584", "value": "24:9c07RbjEcCH0cuBjUNZ7UMMS3X1jQnvJwPIdqYjBTIzFllzU51ZGGOYE37EMYjbM:9JJaHmhUNVUXOlsn4EmFO1oFYELEpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933787, "uuid": "def9b425-41b4-4589-a3eb-c50581e2ee79", "value": 1598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933787, "uuid": "ec2c7c11-9f14-42b2-ac80-3485e4b28171", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933787, "uuid": "3bf23e79-78b4-4689-b653-2e0a3b71f391", "value": "photo-193974676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa448e1a-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923142, "uuid": "64721ea5-104a-47fa-908b-9500d53c40b5", "comment": "Malware payload (Mirai)", "value": "a5498d8578ed4d5b0f5019fe8f1eeaad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923142, "uuid": "026ba94b-6ded-427a-8b17-1823d95a4eee", "comment": "Malware payload (Mirai)", "value": "51657c1258de764c1995bd37d0bc2e7c19671d64a49f1db8be4be464901df74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923142, "uuid": "67970183-f61f-4e53-8594-8e17663348b0", "comment": "Malware payload (Mirai)", "value": "29820be765a6367a46846739543728f651a109ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923142, "uuid": "b457d6b9-2fec-4b41-9959-b33df33d8195", "comment": "Malware payload (Mirai)", "value": "8ea6f4415283018c8d4b571764e9f2f1d28c914ecf61e5dd55716f2ae2040ae404660cc02f1cfc096797e194079a385e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923142, "uuid": "5ddfa6ae-085a-46ad-8e91-23e19c9dbff7", "value": "T1E4B47E59FD4D3D82E2C7F27CDE8A83A1712BB1E4D36381A37591421DD9C6AEECBA0101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923142, "uuid": "2347c81f-6757-45f0-9418-5101698c9dee", "value": "6144:ixk1fB/S49waOvzGffupuA+foxa8TxGyimpwotDchTr/5rHuXkw5EEx/C:ix4/D/Ovzs6XXxr0mphSp7w5EExq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923142, "uuid": "9c832165-2e68-4464-bb64-5ff39297ebe8", "value": 531784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923142, "uuid": "d8940bab-de16-4cab-9e99-a421c0757f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923142, "uuid": "79d20d2d-b0f8-43a6-8575-ab7492f35b8a", "value": "dlr.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626c3a69-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776929463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929463, "uuid": "db74c033-56df-4a0f-b020-c014c9ba3602", "comment": "Malware payload (Koadic)", "value": "003249847aa31c8b67174bb7b938db49", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929463, "uuid": "d7374d18-395d-4d18-bbff-c643cb2adae7", "comment": "Malware payload (Koadic)", "value": "51b7d6426227d8ffb20afb3b3ff78693e15f50755a0b5d72d871471cb6437ad4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929463, "uuid": "f7183975-0cec-47ff-a6a1-036da4e15069", "comment": "Malware payload (Koadic)", "value": "86800052def998c3a70cebee46a1af1bab9bfade", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929463, "uuid": "67622fd5-a7e2-4b1d-8733-19029698fb90", "comment": "Malware payload (Koadic)", "value": "789a2b6e97b6e4c089feeb2e7a85dcf7d957697472b51e1a947f3d74fbfec664470749e3ed97b7393ff6f76ec9089811", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929463, "uuid": "5fe7a7a6-a599-4092-95bb-5c9eca39808d", "value": "T174D130FAD643320B9E588E9761EF873C787468BF1AD9489B40785F528FB511E4E870C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929463, "uuid": "a881c8b4-ae37-4cd7-aa7b-2cdd01dec2bf", "value": "48:IY+5JVDqhXVaAnyKCU2pjrr0bH859lakFzIj63W9tJwUd0bpjrIqOg6Ij63+Vak6:IhfB8FH8a9Fgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929463, "uuid": "440c6e83-89c4-43a4-9889-1b0f2caa1f45", "value": 6240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929463, "uuid": "a75c8543-8927-4a8c-9a0a-b9b66062a618", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929463, "uuid": "bfb6a2c9-eb12-4c81-8af5-b681df40085e", "value": "Bank_Payment_Advse0765789.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2121b3aa-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776928495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928495, "uuid": "c83857ea-f60f-4ae3-8104-bd3cd0bae9c6", "comment": "Malware payload (Mirai)", "value": "a47a864bd1f74efb28e59485a45703b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928495, "uuid": "77086ef7-ab7d-40b0-b331-a5fed682cb21", "comment": "Malware payload (Mirai)", "value": "51c4b2de237c98a933216675a5910af35d887002f8053f3e73b2770736ec3618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928495, "uuid": "b03f5d08-a2b4-4db7-8abd-83e8bf103f09", "comment": "Malware payload (Mirai)", "value": "d31a72557429efee374d49a1d04a5453ec1d214b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928495, "uuid": "e1565330-0d8c-4287-b298-d19ebf8cce5a", "comment": "Malware payload (Mirai)", "value": "358477e3327a47ecc6ebdd936d53d60dc23d7f4bf74b68790125e2dd46be7cd792cc6096ffb37292a0325409b7914a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928495, "uuid": "2a2f971c-f256-4579-b40b-d9b77eb86f25", "value": "T1E1B2E16C40940E05D85B40FF9ABE05E6E66184830AFFC7D99F270CC3E2B74A2791D619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928495, "uuid": "181d1c07-8430-4e08-a674-af9884568ae5", "value": "384:MniiBi3f2PSrf64K5WFSlvNjJ6mAN8bhmglJbN2EIKHT0P6+PbhDYOK6sNrVeCVg:xiBiv2PSbePxNNw8dtlJwEIGT0P1Pbhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928495, "uuid": "c77d346a-9525-471c-9170-27210294f7ac", "value": 23440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928495, "uuid": "12712f0f-d07f-4293-8949-503182686ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928495, "uuid": "f1a85539-1670-4956-8e53-7affd99a4fc1", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c1fbcb-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776938239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938239, "uuid": "0b25a47d-e300-4831-b945-85777051adec", "comment": "Malware payload (WeedHack)", "value": "3b3eaa7fb38a1bc3ac7d28f8782c9cc7", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938239, "uuid": "88746bd3-40da-408b-b2f6-9a9821cb582f", "comment": "Malware payload (WeedHack)", "value": "5219e2153ee7c7adb4e81b4d136ae993dc4e9fb8e94d2858c42f4844253d78a8", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938239, "uuid": "d83bca57-0c5d-46da-adb8-8dcf0f35fec7", "comment": "Malware payload (WeedHack)", "value": "27471ac05683f86644548152c63648d1684b167a", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938239, "uuid": "c1f88cdc-d579-4bd7-b30f-63972ad19e86", "comment": "Malware payload (WeedHack)", "value": "ead01be43a8a4668281c233ac244847fa1083531fb2aaca1b1b6a60fd137e473133f916cb94a675ecbb9c4805832adb8", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938239, "uuid": "b18fe7a5-c0ab-4544-afd6-f68b48900ab7", "value": "T12572AF2EC690A479E9B9183CD40F057396B924519A80BE0F3610B26C3F6929757CF3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938239, "uuid": "3c2f2513-c66d-42a2-8be0-d90ff34e6cd0", "value": "192:K20IFhUF9MJ6+T+F9pUUW6lTYMSxdnPR80B+PqILefHUmz7zbZJ4K6Ll2XNKOsI5:Xz2F9MJPjhlQLefHUWbT4K6woaa74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938239, "uuid": "33c20afe-d2fd-4dc1-a759-ba2db7c56e61", "value": 16431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938239, "uuid": "c2b47f65-ac78-4fe4-90a2-4e6f8743981d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938239, "uuid": "ace8fdfd-57a8-46e3-b8aa-8ec8a8b7027d", "value": "5219e2153ee7c7adb4e81b4d136ae993dc4e9fb8e94d2858c42f4844253d78a8.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad5c56-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776912388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912388, "uuid": "29d3ea5a-f03e-41ab-9b35-74c794f36c12", "comment": "Malware payload (VIPKeylogger)", "value": "249dc8a9dc96ef5f65a96277e2e022e2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912388, "uuid": "d9e21f29-e9e3-4d83-a43a-f29087469234", "comment": "Malware payload (VIPKeylogger)", "value": "5364a6db5cfb43f056be8dd0102124a425bd7b02c406b2f4af822b3e18106144", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912388, "uuid": "78358b0a-cd8d-492d-9521-ddcba4b2b8d4", "comment": "Malware payload (VIPKeylogger)", "value": "a773c006c415ba353cf197f9e254999d3860dbce", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912388, "uuid": "ca8dda4d-1ade-439e-87ba-ff53cf3d7cf1", "comment": "Malware payload (VIPKeylogger)", "value": "31a6aad3aa89f487423efc4335505a767ebf7b9be32c3e5d37d149d941085c86f643cd4a82b18db80f87546a7fde43c4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912388, "uuid": "4b374dba-5f91-48bc-996a-3406677e9330", "value": "T1B30412396A2C50EE46B2F6933661697E43162819F4CED4C805F88FE5AF7D34C05DBAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912388, "uuid": "9129158a-5f5f-4e59-9f79-6288becc8471", "value": "3072:p8Ry4KnWMXkG3rIMLaSGukoYSQWLEL2gDRWVjVCZ0iF07gpk7xOThzqwIG8lkZo:p8RbKWMD1+SGahq2I0WZ9NgxVwI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912388, "uuid": "3da132aa-a7d8-42c5-9ec4-e56c87d8790e", "value": 181104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912388, "uuid": "454e5c2c-96af-4c73-8e22-f8017945a659", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912388, "uuid": "ae4e9ab4-2ba4-409d-b28f-b538cc6f0447", "value": "Lunch.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543c96fb-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972389, "uuid": "98001bbe-0032-46e4-8604-c40e3b51c55f", "comment": "Malware payload (Mirai)", "value": "da1be076fafdd7deba47248467594871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972389, "uuid": "9cd85142-1f42-45d0-851a-0ccd961d9c2f", "comment": "Malware payload (Mirai)", "value": "53d20f7aa40a593ab595be2512589048a2cd9e99ac802f468f597637df9cb665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972389, "uuid": "0b3dd335-59e9-483f-92c2-b5567dbefd4b", "comment": "Malware payload (Mirai)", "value": "9f5d0c69d6eadfdce47f54ea06dfefb2645f364b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972389, "uuid": "e9fd11c4-3231-4230-974e-20e32b05cb98", "comment": "Malware payload (Mirai)", "value": "887895c79011e8a55b58c64525fb616b43c6eb7d2d34a17c949e662056ef4ee5bc9c24ebd8966151ed3f8729c65aa4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972389, "uuid": "f241b7a5-c444-4fd0-b33b-97d86a2ffc8e", "value": "T18A24C70A6F950EFBE8AFCE3742E90B0525CC551722B47F3A3674C528F54A94B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972389, "uuid": "a408302e-13a2-4c4d-bb21-5a55012a959c", "value": "3072:4Rb523+KIupD8BNh1VAS+/o9OLgmsPsipCfLyS:4RbIIcD8vhz+w9OANwLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972389, "uuid": "e5f2cfae-13f4-4d70-9ee4-a0d65fd8fff9", "value": 214628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972389, "uuid": "71de1358-afcc-483e-8db6-adea977f6af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972389, "uuid": "ee04029d-f001-499e-b575-c3f405fb74e7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65297d74-3eb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776907564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907564, "uuid": "de5977ba-cde7-4871-9de8-13363ca3d73c", "comment": "Malware payload", "value": "49d264bdc02f0e13fb5d626557cbdbf6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907564, "uuid": "780ef6f7-6877-4767-86c4-e721c85405e0", "comment": "Malware payload", "value": "549f9fed39593ad71da295a4a37c2399d80768f875c2c7ec1092a992894a5668", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907564, "uuid": "ec1a69aa-5a3f-4426-8fc4-a172d84f9c33", "comment": "Malware payload", "value": "be79a8eef7c6ea33b0ae08d862d6d945c7e5b0a8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907564, "uuid": "88d8ae22-3149-4706-9492-8dad05dfe619", "comment": "Malware payload", "value": "f90492e67a725d86afb7a8ea1fa96f9efacae8b4b6f9da87f534f2644baaba3ff911e13e595e50ce0162441991482675", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907564, "uuid": "226b6c42-9c25-4250-a46e-0d31ce451cc9", "value": "T1B11602484DBBB2061FCDDB45F39BFFDFB85262A2F941122470AA5DC933A12561C6D0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907564, "uuid": "56ef54f1-ce33-40db-ac6c-01634aa114c2", "value": "49152:lJ4gJFxW/FT2kbPwsSIvotfesFSSsB9fmbJ/N+OuBVmYxh0qn5+7ioeZzpoFzr1:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776907564, "uuid": "2687aa7e-1296-4d03-b06b-71398c49952e", "value": 4285685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776907564, "uuid": "78b7dc4d-6768-4dc2-9cd5-c97d8324fa39", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907564, "uuid": "a48b8dc2-d95d-4c41-81c0-873b5edd0022", "value": "svchost32.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293e10b7-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976183, "uuid": "a59d9d1d-448c-4b3b-8183-6470b2a856ce", "comment": "Malware payload (Mirai)", "value": "3a9d11a5d5fc1304943c8b89ad5f4d4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976183, "uuid": "bdae0566-b381-4550-94c5-ae0b0d73c299", "comment": "Malware payload (Mirai)", "value": "54fb745d32302defb8ecc334e5260fbc2840f252f243ad022906bf7bed699625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976183, "uuid": "6a11d94e-3955-4666-b72d-4534c71c705a", "comment": "Malware payload (Mirai)", "value": "92cfbf05f6a2caf72a612ddefbf876e7b2417ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976183, "uuid": "2ce6d2d1-ff4f-4b4f-9b97-a7199ab5f309", "comment": "Malware payload (Mirai)", "value": "9e8b6859de9f5868c53e9e9405313b23f4ba50554dece65e62c292e876b8025ac9baf83dd053add0977c71f4bb9e09d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976183, "uuid": "72c08c28-0a7f-4e56-bd15-cfc69dc35107", "value": "T1DB434AC4F143E9F5E85301741026EF379F72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976183, "uuid": "b2768850-c766-4dd2-8288-76319e3858cf", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmceDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6am7lWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976183, "uuid": "d5f02481-7bdb-45ca-a9e1-1c56058620e6", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976183, "uuid": "bb91d39e-3892-4a90-893a-d1e2fedd44be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976183, "uuid": "75abf482-0921-46a3-90ba-19e2cd54fc18", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dcd4e2-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944789, "uuid": "a6c7df31-e177-43f9-acab-c7053c48859c", "comment": "Malware payload", "value": "d21e7791e361e0182381e36525951e21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944789, "uuid": "29e35af7-3ea3-431a-82b1-440fe0c861dd", "comment": "Malware payload", "value": "5515e24b8d303cd91e89722d9d0477cbde0dad2e07e200f16c1118c31fdb58f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944789, "uuid": "281e86db-0d1c-421b-ad25-41dbb2d6266b", "comment": "Malware payload", "value": "82aa25529caa9b403df2180f07b1dbeec4846f92", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944789, "uuid": "39938817-5288-44dc-8119-909c42600a4b", "comment": "Malware payload", "value": "1e17e087e44d66bdfbfaa79c67d089afe3a84fecb865e8bd34871dca6527278d914e5d21bca88b88cf6f740d4cc47cd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944789, "uuid": "b00b7d41-c440-4d1a-b61b-66e7e9f7587c", "value": "T138714406D7E4462BE0B74B35BEF34713B6B0FC949FA3572E59804234AC617A45DB1BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944789, "uuid": "f0123984-1fef-4f29-8e58-62aa1e9eb968", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944789, "uuid": "6fb990ff-1954-4b24-9c38-46301ea328f6", "value": "24:etGSom9Rz1Q5DFcd3fa3a3aiFBwhVJyitkZfI7d5moNFDb2WI+ycuZhNEakSgPNq:6jYqqWehVJcJI55mKb91ulEa34q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944789, "uuid": "8fb1cedc-4b1f-45df-af42-546b526fe8be", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944789, "uuid": "84008016-cb17-492b-9c9e-1b5053bbd446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944789, "uuid": "3b845b51-7614-4002-8f04-64508c6a7b18", "value": "li1ubyag.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129df62f-3f3c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776966266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966266, "uuid": "39a571e4-6e97-4361-b79b-3c6222fb3efe", "comment": "Malware payload", "value": "1ba44b3a863a583c9dfb3f7057d23ed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966266, "uuid": "0662508a-8ffa-43ea-a016-2eb39e36d518", "comment": "Malware payload", "value": "55da84bd24bef465f5db0b81f3d1d1fc202c65de4bae97b207218a992185c88a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966266, "uuid": "ae2e3a6e-9522-4241-a52d-2a4b8326b578", "comment": "Malware payload", "value": "0c3f9c03feb74fb5bdcfeea79a590574a4719b1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966266, "uuid": "6cc78251-b903-4772-bd64-78b7b7eea695", "comment": "Malware payload", "value": "4ed73bc34fa3023bb0539678d5cbe376e1d0389b73c0eaffeec2eb4398cbf4620eb6a3c957166fe4ccc8713e80213823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966266, "uuid": "9bdec850-97e9-494f-8b1e-c1659d6babcf", "value": "T1FB530252926E5D74D2FC09797CA9008D172E6D37E0D660608FA4C098789FC9E74FEF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966266, "uuid": "d33613b0-65ef-496d-8faf-93081bd4f3f3", "value": "768:kcxmLmcGbtlxJHKNMyWyV7ZPO0knh/QtbntU16BCQ5gbX9aTWFbsdPF5NJOmxL31:kcxw2zx8NMK5ZrkWk4BC5aTWFk3fxY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776966266, "uuid": "29a89ab8-c14e-4daa-b619-660971b29c36", "value": 61420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776966266, "uuid": "e3ff7d3d-e91f-4f2e-8f3c-d020024aa424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966266, "uuid": "d165b064-913b-40d2-a674-a9a76f0b5a8f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac8d162-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776930847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "4e85cdab-f8e7-445a-98d2-0eb982051526", "comment": "Malware payload", "value": "219f038794e237647a3c8107aca6d547", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "0111d274-647e-4262-8ac5-ee4eca6fbf9b", "comment": "Malware payload", "value": "5619599648e5f7ada4897b1cc9971dd3bb63104f43e82a2d433fbfe24792756b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "f1e63ad4-8aaf-4e90-9f0e-2b44c53f6cf4", "comment": "Malware payload", "value": "3b138c51779ca92f874543fa5e499a14513ff789", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "ef42571a-09db-4bb2-9365-1069e4046426", "comment": "Malware payload", "value": "2103160049518b93caaa1df46b2adc54be90f83bd91c604d7c03c3f6471c835df47cfea3c703048b9baac465eb1ee9be", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "7ddc3484-6413-41d5-9c87-21f273e189f3", "value": "T1283633D7BC43AFBED4AE4EB48401E41C4635A7091F04D273224D6B2A76A7F63B6D610E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "64d10925-8304-4a37-afe2-c09b63f13154", "value": "98304:heqgqqNGnFqoHEh0xUtYlW7lF0VOpaLEHkf3wBHnSmv6yyGNwCFRr:A0kGFqovPw7QVOpNHowlXy23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930847, "uuid": "ecdabdd0-ad47-45ff-814c-938835430042", "value": 5149184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930847, "uuid": "eb93f403-535b-4921-ab95-6a6a9cd64100", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "e64427d5-3c1d-4009-bde9-8a75424a77a3", "value": "5619599648e5f7ada4897b1cc9971dd3bb63104f43e82a2d433fbfe24792756b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a74d01-3ef6-11f1-a769-42010a9c0008", "comment": "Malware payload (GoGra)", "timestamp": 1776936524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936524, "uuid": "57439d76-07d7-4e98-a37d-52883ba7b50a", "comment": "Malware payload (GoGra)", "value": "abfe90bd06b0781a075ed23757822816", "object_relation": "md5", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936524, "uuid": "376e1baa-7faf-4050-9f20-cf3277c3f044", "comment": "Malware payload (GoGra)", "value": "57cd5721bae65c29e58121b5a9b00487a83b6c37dded56052cab2a67f90ea943", "object_relation": "sha256", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936524, "uuid": "668236f1-4683-410f-b1f0-74a7fe88662f", "comment": "Malware payload (GoGra)", "value": "afce743ccdd089a4132aad647ed47ba13b3f83b0", "object_relation": "sha1", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936524, "uuid": "ca1a9501-2c8d-4bfb-ae98-e8a96329f8e0", "comment": "Malware payload (GoGra)", "value": "9eda7458d6deb473c49433782dc17699ec3ac8ff0e46c569d9c2e7384688bf4916abf5e6b32d71d3c4c89efb372ee187", "object_relation": "sha3-384", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936524, "uuid": "685dcec2-6307-429a-bb0c-46755cd3ac9d", "value": "T1E4F533C24EF6EB558644B7F75E58918015B320738CA9D09AC05AB3379E87FF0188ADDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936524, "uuid": "64ffde49-2957-4d65-815c-84cb2d91fe52", "value": "98304:6ytZW4WMohKECe5dHu2AuDIeOtnkL4gDuwQ8M3Rp:6y3WhM+K4VfAUIbgDP/Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936524, "uuid": "6ad38c80-7c9f-48fe-8278-d1455b615a13", "value": 3368710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936524, "uuid": "3ebc5367-bf40-4f27-9273-b37d801646f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936524, "uuid": "1df5adc9-156f-4280-9db0-f11762c86f7f", "value": "TheExternalAffairesMinister.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bce3b1-3f5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776979646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979646, "uuid": "21c3316f-c0f8-498c-a4aa-397aa3167ffa", "comment": "Malware payload", "value": "d971f42eb33350b95d67a2e42ffa4bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979646, "uuid": "9a7d0e0e-ce93-483f-a121-956451247d7c", "comment": "Malware payload", "value": "59c7a61df1d6e8ca21e8262a9022f751732bf4d9cfecdc3dc041c0191e08c7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979646, "uuid": "f8ca77b8-55c3-4120-a227-3834bc402924", "comment": "Malware payload", "value": "9a448df0c932659975177ef68e448c833cb338e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979646, "uuid": "b720895a-fb21-4ec0-8c1c-e90327e01f07", "comment": "Malware payload", "value": "7776c4aaa1e0808809fa6a10058196ad33d1d62aa790dc81e01fdf240e21707066c45e2fd15c6e9fa5143ea1f0a524c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979646, "uuid": "69b69706-b31f-4783-9895-2189f479a355", "value": "T1C1B57D0AB61D00A6C5EED17D8A43990EEF7034524362A7CB36D4DE5A1F53BE09EBE740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979646, "uuid": "101e8905-3d37-43df-951a-1ca00319fdf0", "value": "b8b05be14f2a5ac3fb6ee26eb9fc808e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979646, "uuid": "1da614bd-1549-4b1f-aaaa-968cbde9b79c", "value": "49152:uYg1aj4rCRJlNsF9XjmKk7s/OXjuvkC1TcyOJhQ:vg1aDJlcQn7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776979646, "uuid": "dfda0a1c-0dae-44a8-a51d-cf70b49d0d10", "value": 2340656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776979646, "uuid": "20671e54-01f6-41ae-bea0-9e05597c6922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979646, "uuid": "49b4cc37-1553-464e-a8b3-6f6969f84228", "value": "CCleanerReactivator.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b4e5a7-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923075, "uuid": "0093d966-2819-4436-88fb-b464fe28e220", "comment": "Malware payload (Mirai)", "value": "21db9c0fc8c6d2dcb07a363eaa4f8035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923075, "uuid": "df1a1ff9-c4e9-4910-90fc-171d7c8f0854", "comment": "Malware payload (Mirai)", "value": "5a07168bf087b0ebf5735ff4757dd00a59a95a098d15fb8a42cf588ec04ccc94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923075, "uuid": "723819bf-0757-4cb9-8b91-f9f41158a99b", "comment": "Malware payload (Mirai)", "value": "3f7b1d7879a0ec24ae464f209839c976a2265555", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923075, "uuid": "d0f1a9c4-9060-4ca2-a4fb-45eb733dd87a", "comment": "Malware payload (Mirai)", "value": "3396cd1cab19e459b7ed20342649bf18fa8db0366f4bc24c3bd2e9139ef3ae48316ee8d9beadd2d0739c273287bbb8da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923075, "uuid": "2aef4c78-4942-4719-99c1-2afb63d613a1", "value": "T14B533B16BED25E56DC3ACA34842E134B17F19A9E97C1932760788D8C79FC7509BC3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923075, "uuid": "6da78002-0b77-4a1a-bb56-10b24a170db3", "value": "384:Da838jEouyh6oaKR8ZaZ2hCj0N8z5+xwjZb8H8EsgG/HptibEB+IYwc:p3SEb88Zakha025+xw9VA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923075, "uuid": "97849ebb-772b-4ae0-b11e-d4e2d7064ac5", "value": 66584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923075, "uuid": "13b90721-edf0-4a33-a72c-f5bb1a54d6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923075, "uuid": "19fa4a9b-f344-4b23-b2e8-0d121ba098f0", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19dfba7-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934348, "uuid": "f38222da-5e95-4a57-92b8-0666375945a7", "comment": "Malware payload", "value": "04211efadec71f50f7b33026d7d301b5", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934348, "uuid": "2982723e-e3aa-4787-91c5-4a1df186d1c1", "comment": "Malware payload", "value": "5a607965caac6829cf9327c795fb18ae6a318e687a2fdc922222f3c0de167cbf", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934348, "uuid": "4bec513b-9424-425b-9e4a-170191c5588a", "comment": "Malware payload", "value": "4fcfbef356590b1796ba9f5662deb5e1909ddb48", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934348, "uuid": "8d0f8b2e-d25c-46d7-8435-09d5ac183fcb", "comment": "Malware payload", "value": "5a1c3388fa79e2cfe317b4a36fca3d0120360615b755b0433d46fff55eb38a2b28e5d81f5bef1a6c348a95f85f8b65e9", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934348, "uuid": "8e66937e-b9ce-4947-bfd0-ee71e0b556ec", "value": "T181D6332C75A62847A7E821BB74A44FE4B23440713F59C053AA53CB99F2A70E58F53C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934348, "uuid": "d0a531d2-b25e-4e49-89cd-1c0e66ec85e0", "value": "393216:6oq22f5BFLDQSv+nSAKV0VMvVt8iHK9m2/8rzk:6YAFbG9Y0uVq9nkHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934348, "uuid": "8ac1f745-b501-414d-b1f4-c1b7c2ee6743", "value": 12736285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934348, "uuid": "296e3aa2-62a4-49a7-bff9-f6d3dc1f6b51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934348, "uuid": "6bede4a3-2125-46dc-81a3-93a4edc96896", "value": "ishod_6726_dolzhnost.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa6ace1-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimwolf)", "timestamp": 1776955927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955927, "uuid": "dbc4501c-18c2-42ee-8c4a-90c22e42f63a", "comment": "Malware payload (Kimwolf)", "value": "a8e96023e850da8f728b9bd9f2f22aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955927, "uuid": "ca67f60e-a69f-482e-9efc-6f0e6a6b1c2e", "comment": "Malware payload (Kimwolf)", "value": "5a9189bf7f420d5b6405e534d043e5485c733a8b4a6d21b4c7b9d3a6cd2532ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955927, "uuid": "e4d3b798-76e8-4912-b9d5-988726f374da", "comment": "Malware payload (Kimwolf)", "value": "ca422cf8bdaa7978f6714760c43fafc5d2cfc40d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955927, "uuid": "7db10485-9ed7-4c22-87b6-4f08c41b24e5", "comment": "Malware payload (Kimwolf)", "value": "d950099f2454d9cd7f782f3efa794b44e3ba26dbe35672e4d8fbaf0319bfb2dd5f360be31df641952356b6f3ced36924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955927, "uuid": "1f32b3e1-3ca7-43a5-a8d1-c560573c3b63", "value": "T127153347BC5359F5C2C47A08317AC21D245A567F940BB807197BBF63BA8AB8021D4BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955927, "uuid": "d580e00d-0a29-431f-a782-db4d43a739bf", "value": "24576:UnDxWJPMXNqWO77Djf5pqSmN46XVhih1QnAlQADLaGW:UnDO0UnfSSm5Y1QnUtdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955927, "uuid": "3e4aac09-dae7-4fd4-bad4-28d0e0604740", "value": 888644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955927, "uuid": "f1bf06d7-a1de-4dd7-969c-a1eeb1f5903a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955927, "uuid": "b34e9a12-2f9a-4037-90f9-8c60ea40a7b7", "value": "5a9189bf7f420d5b6405e534d043e5485c733a8b4a6d21b4c7b9d3a6cd2532ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39296024-3f13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776948722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948722, "uuid": "9a11dd91-a1ef-4f51-b278-4de2990a7a2a", "comment": "Malware payload", "value": "960599030405f60897978b1358fdcb24", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948722, "uuid": "ff55eaeb-6ebd-4c1f-a70e-b7f3ae25eed3", "comment": "Malware payload", "value": "5ab10f0e3dc4e7eedda9a2354061d8f3a93772a7251681e3a92af32a793053b1", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948722, "uuid": "f5b1f307-1e83-46a1-b6b5-9b1180f712f1", "comment": "Malware payload", "value": "76c166eb1bebccdc0562c57308cb15bc9f67f987", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948722, "uuid": "36fbd985-4f74-4817-8620-3631f4496f5a", "comment": "Malware payload", "value": "eec13a856e8660ff10959e079d63f31292c3d438882b4b9c9495a9f5d571a8dd112b1918edb0eada08093114a770e9b5", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948722, "uuid": "d280a158-8e8e-48b3-b74b-5725e7c3dbc3", "value": "T179459E56A3A802F9D0AFD275CD06464BEBB2B8461770D78F13E44F962F237615E2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948722, "uuid": "1f593e76-c14c-4dca-a5a7-ca2122abadae", "value": "f8f789e6abd0a2705878c10b09431d34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948722, "uuid": "f3ddd870-8fbb-46ae-902a-ced93bdc5007", "value": "12288:jkTvMRxiMzn7Y8RTUOJ1pIEd10iub1z2vdlBIy9JICNKUZ9pXvVbj7h6shmqi7jM:jk7MRYMr/jVf0VB2vPSyLRvpRjdV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776948722, "uuid": "83b4175d-a60f-4658-a5f4-385fbdd283ca", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776948722, "uuid": "f3a3695e-17cc-45a3-9dde-77c7156bae67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948722, "uuid": "95a7345b-4a78-482e-8f6c-dbdaaa4ecd94", "value": "5ab10f0e3dc4e7eedda9a2354061d8f3a93772a7251681e3a92af32a793053b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f778344d-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944746, "uuid": "116f15c2-7b48-4912-a078-4eba13c53ef4", "comment": "Malware payload", "value": "cfba9e05f3554333d0f7446129379b28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944746, "uuid": "c8a4e044-2226-4557-84a9-ee3f8f2ab1f1", "comment": "Malware payload", "value": "5aef7f2cc8dfe7d7fabc6f021c1b0337c5cc562e2703b106facded801beaf31d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944746, "uuid": "11a4fddb-4e9d-48b5-a141-8f7c5416ed3d", "comment": "Malware payload", "value": "8ffc5242c89013cb0c8f190cd11ac5c54678be6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944746, "uuid": "54eb809a-c465-49df-bfbb-44a1fe5de46e", "comment": "Malware payload", "value": "655a127387a6538fb1d2905f367aad6444d394c666004e7a8d0a8e20239e0177f0cf1deba4ee4283303844fc8f5654f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944746, "uuid": "c828474f-ea06-45b2-a154-2306968e10f8", "value": "T1FD71330797D48566E0B74B30AEB3834766F4F8948F734B3E09904214EC626681AB1FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944746, "uuid": "cad95c40-b013-4ecc-b8bf-418dccea164f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944746, "uuid": "a7e3dabc-e615-4c13-ab5a-901ce734af2e", "value": "24:etGSv/E9Rz1Q5DC+UGIj4PtkZfFZ5moRFDb2WI+ycuZhNnakSZPNnq:6YeuJFZ5mAb91ulna3bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944746, "uuid": "d6367fe6-0d4f-4176-86c1-5ba1b933b49f", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944746, "uuid": "027b9c91-1c63-4bd7-aa81-d13066f257cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944746, "uuid": "47ca6fe5-d9e3-44d7-9132-a07e717fb493", "value": "3yswxkbb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e3807f-3ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776933922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933922, "uuid": "1c63729e-2b27-458d-8d16-7710324ef27b", "comment": "Malware payload", "value": "0a4bac714602fb338c3fa9250cb2bfb5", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933922, "uuid": "088451a9-9413-40b9-b3b1-4fc1af8d87b9", "comment": "Malware payload", "value": "5b47e78a64ad84afed2eb9e983fa42df5ba69d8c501ee47bf3bb8c13aa81931a", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933922, "uuid": "f36d958d-9e91-49da-a3f2-8a012941b975", "comment": "Malware payload", "value": "77bb9c87892ad65326660e63a00bb774bfe20495", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933922, "uuid": "2eff374b-fcde-4d93-9290-42b4dac0cbdc", "comment": "Malware payload", "value": "b33c63970f69d45a21e6d7353a0829bf6c2d3532672b3d641cb9e1f1db745811cf087c1d4171952ca59d63eee34f01ef", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933922, "uuid": "9606b541-c9d5-479d-b33f-07b5a8a942af", "value": "T13F465B217A5A99ACC05AC47483478A725A7530CB0F36B9FF44C496783FAAEF51F3C258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933922, "uuid": "93057731-8c0e-4a4b-bf1c-e40e59b45371", "value": "fd6f3597431b39ee76177eecec3d5e5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933922, "uuid": "361957cb-8b01-4410-9578-487e23d05a8a", "value": "49152:wwbTkucQ2HNVuIxwploNfEMrDof58qAqpLfwXmRUvcjSYgV02eIrUP1G5qFTLWYR:tl6K9wfEe7AyqiNTZu5Ak5u+X11X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933922, "uuid": "ad06619b-0e09-47bd-8141-050ab585998c", "value": 5655552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933922, "uuid": "7ace8459-aa79-4095-86bd-f7db3a65d0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933922, "uuid": "bedac41d-ae60-4002-b2a6-b5235eb2684e", "value": "5b47e78a64ad84afed2eb9e983fa42df5ba69d8c501ee47bf3bb8c13aa81931a(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e79995-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968345, "uuid": "a4b42ee0-5b28-4b8a-b2a9-6954d647c839", "comment": "Malware payload", "value": "17cc34dc776f0a86bdda36f461133907", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968345, "uuid": "eb0535f3-cd7c-49ba-9c16-2ac89c7612d9", "comment": "Malware payload", "value": "5c28134dee20ddff2f35385867cb77727da73183b0aea42ac42a5e32007625e8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968345, "uuid": "ba88402d-aad2-40b9-879f-279743a604c9", "comment": "Malware payload", "value": "db2760eab3eb2a32d9ed1bd7b18b53df2f478a66", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968345, "uuid": "d79252b5-6d6c-40bb-8979-5ac99d2cc64f", "comment": "Malware payload", "value": "bc62b79501171f59b8c653753fe7ca892bad4a8d8584a55d9f09f4c7f9e6f9b4f1ca7891cac9a7ec73f0222d095bc8bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968345, "uuid": "81fef41b-a2b2-40bf-af57-0655499f5026", "value": "T10F060186BF59952FC8B700324FA6827632568D13CE829B476458372C6CB7ADC0F5DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968345, "uuid": "c1361364-5785-46e8-a091-2d5181dead58", "value": "98304:wu1M5fzrcPQ5tSJ5Et1LrS691cDQ/Dr6kuh8JW59dUJ3+TET3:wuifzoPCtSUXGyenVEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968345, "uuid": "d2b0a139-a8d0-44ad-a357-42d85e9b9221", "value": 3999151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968345, "uuid": "e26596bb-b717-4883-a73c-b699a414d3ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968345, "uuid": "030e5fcf-1769-434e-93a5-6aff5d58011a", "value": "5c28134dee20ddff2f35385867cb77727da73183b0aea42ac42a5e32007625e8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71184cbd-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935072, "uuid": "8279e32e-8d21-4845-bfc8-a0aa5e3b2e20", "comment": "Malware payload", "value": "ebe2d34a9c65ebf5fe11a588b35ab07b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935072, "uuid": "fa8914b7-9bdf-4827-8a59-fe048d3abf8a", "comment": "Malware payload", "value": "5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935072, "uuid": "a438e019-cb09-4bad-ae07-61d14e699919", "comment": "Malware payload", "value": "d094fba06ede63de45471f6ae656716e8c0f9571", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935072, "uuid": "2d6d2b28-d02b-407d-9cfd-ec68afc37dee", "comment": "Malware payload", "value": "f476fd3d725e7d92b60c8e5b35dc683628f4e0e79131ee49c02ef149a0da9b0e88dc57f76ed9d0c66c54e5e507f4ca48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935072, "uuid": "41004bbc-cf78-4ed5-874b-ee6f89d1af11", "value": "T192C1A122D7D90926E8BF4B3CACE21B8253B4B44C0BB20B6B1DD851076C974946933BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935072, "uuid": "13630d9c-023e-49c4-89aa-2339a2cb8f27", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935072, "uuid": "f474eb8d-4a98-4969-9f4c-d382ca219277", "value": "48:6NpcrzSjsj84XdCXVZPmXBkrZRJrLHNr9oQmkugzNCCYShXwiyaaZlqglSto4TmK:Vmjsj84iHm+Ffmk5Xwj7S301GGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935072, "uuid": "5d7d083e-8e99-4ea7-8848-c0467e124f31", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935072, "uuid": "d1ffffdf-c7f0-491d-9dc8-4e89e63d6dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935072, "uuid": "8abbcad0-9c35-418b-803b-fe24f209ef85", "value": "5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed011d9-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982205, "uuid": "181242e3-47fd-4e31-a918-9662ac6f5bdc", "comment": "Malware payload (Mirai)", "value": "3c0dd906782e96bd46560fb24c3a9093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982205, "uuid": "51779070-30f4-4154-a6e1-12162414fe3c", "comment": "Malware payload (Mirai)", "value": "5c8b52c7266289791cd96d8d215009830d73c51849d42ec14cefd977066d4298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982205, "uuid": "b9444a97-9651-49f9-973f-92fcfc7f0065", "comment": "Malware payload (Mirai)", "value": "a869dcf13b060c6e684e5991489c92e108a77cbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982205, "uuid": "487ec01f-519d-4249-ab31-bb0b292e2301", "comment": "Malware payload (Mirai)", "value": "3ace83b051fbd27d1333ae519fcf3a01d4258b12499a8939b9572f94f77b8098fcb4bd86f0a3a40e74cba4199717361d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982205, "uuid": "30f651f5-8b4d-4c57-82c8-2f6123547747", "value": "T1AAD33A1BB4C180FDC4EAC1B44B9FE636DD32B4AD2234B15B27D4AA221E9DE305F5DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982205, "uuid": "2bf0146f-4d70-43d2-b557-9bce531df38f", "value": "3072:Gw2qNWLADAob3EF+aogCVE2Mwf6cTOyYgwG:GwbD/BXvwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982205, "uuid": "72490d43-125e-4ade-a1fa-ae59a6814bd2", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982205, "uuid": "4df3d28a-090c-4563-99d2-884ac0f091d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982205, "uuid": "9e70c1c4-e7b4-4b39-a2ce-951d8e4db57a", "value": "concakhbtandhuy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08312d38-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776931030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931030, "uuid": "3c4d58c9-0634-4280-9646-5cd1e10e614d", "comment": "Malware payload", "value": "cf8bc7a95d80b9b1577171b39e906cf2", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931030, "uuid": "782a0571-0de0-41ac-a323-dd8060c9afa6", "comment": "Malware payload", "value": "5d25fddd2df4aea89361d098b8b0139eb5d03c499706ad2726348ab9be90c207", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931030, "uuid": "da5ec8cd-0da1-4080-8e71-6782257bc4d7", "comment": "Malware payload", "value": "7b732679755d5ca2edcbc09763660a4044e89a89", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931030, "uuid": "b43d13f2-8050-4cd0-9529-2720e926a423", "comment": "Malware payload", "value": "b4b116163df6416fe03e579242c3f856a5260cf36ca86665d98710d45bd7492ad4fca919ef759aa4bfe3a39cef801de4", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931030, "uuid": "99c11db1-f0c4-4560-a45d-080177fa7238", "value": "T1D93633E758137CDE69BE5E895500F0489A38F31D5E48E333118D5B2BB95EF83EA9600B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931030, "uuid": "4fce4450-324c-49a8-af22-e4dce01430c7", "value": "98304:JeqgqqNGnFqoHEh0xUtYlW7lF0VOpaLEHkf3wBHnSmv6yyGNwCFRP:I0kGFqovPw7QVOpNHowlXy2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931030, "uuid": "7f063263-cc3c-412d-ba98-ec5b78311269", "value": 5085040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931030, "uuid": "cb138874-20e4-4c51-9125-8850b32d7e10", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931030, "uuid": "e5c0c724-7ffc-4b2a-9e02-1482d10b16f2", "value": "5d25fddd2df4aea89361d098b8b0139eb5d03c499706ad2726348ab9be90c207.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605a8e7d-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944492, "uuid": "54f487b7-bd1c-48a9-9edb-3340eddfea6c", "comment": "Malware payload", "value": "23ad48b33d5a6a8252ed5cd38148dcb7", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944492, "uuid": "7a8683b6-5400-4978-8ad4-489f63086d55", "comment": "Malware payload", "value": "5d3a6340691840d1a87bfab543faec77b4a9d457991dd938834de820a99685f7", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944492, "uuid": "2a342395-9bdd-4f4e-8fe2-83011d141d61", "comment": "Malware payload", "value": "ef73e844f9f0e96f80338a50e769e5ab695b3d6c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944492, "uuid": "8bdf769c-7d4a-4b6d-9acb-8780de559b22", "comment": "Malware payload", "value": "7f5d8dd4fb5b8b97beb08c252709bf5e283c90bc530d035799324f971948072c0f4e1e55fb0c5c52d8d6c85a08eb0042", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944492, "uuid": "40215486-6c02-4c2b-9de9-722a46ae0254", "value": "T1D3F433F104A6E89CF64B57611DB9E9EC6D5BD0B34A0F48334CDA85F5142BB4813A3CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944492, "uuid": "a2d5f6a4-fb50-4bd5-b575-d0fc347e5f78", "value": "12288:IKk6i+hWJrFb029KLPnUaByy1nuL8k7FJkyB0x0YdlrKiU9epCJLJrm3sD1UeDom:YwMrFYKKLPtYEnO8k7FST7lrKiU9ECHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944492, "uuid": "03d6e155-7eb5-4363-9531-7ae38cd7ad04", "value": 771395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944492, "uuid": "d0b33ab1-88fa-45e7-9ec8-278cc6fcdf5d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944492, "uuid": "054aaee2-3ffa-4706-be41-e9ef26925869", "value": "5d3a6340691840d1a87bfab543faec77b4a9d457991dd938834de820a99685f7.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0472e6ab-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776945627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945627, "uuid": "f1aa3b1d-0854-4287-ad25-87f32b2f367d", "comment": "Malware payload", "value": "51d0d1482d0e034b3ef2ee6fc83719a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945627, "uuid": "19950444-8b4b-4b82-87ea-35faa156beb6", "comment": "Malware payload", "value": "5d784d3ca02ab0015b028f34aa54bc8c50db39f9671dc787bc2a84f0987043b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945627, "uuid": "05160d03-354c-4105-ba71-22648973b0fb", "comment": "Malware payload", "value": "fe9ad4a7af08803ead89148067a2736c335fe020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945627, "uuid": "9bb5b855-6bbc-495e-8591-108055d63ed2", "comment": "Malware payload", "value": "9c659984a54695bdb0a57c1f90082b6515c30854c27c234342695929e1cc8fe60227efeda038ab0c0e7fbcbe50ffeec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945627, "uuid": "c35532e0-a026-45e3-a020-74490fd48417", "value": "T19974B44562ED6A93E5BF8FFCD83848EB8335763B251DDB882DA234CD5920715D420BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945627, "uuid": "6af8b75b-437e-4598-88b8-0f24f7c9ba11", "value": "6144:XVgCVuMTz4VZgDLMlLYWabt+z91LxjbxMRp3wLZ:neMVK9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945627, "uuid": "977d1e2a-80ca-430e-aeea-b250b43d88d9", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945627, "uuid": "c342f978-e69e-484e-ac28-61544e643988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945627, "uuid": "f4d0af18-71b4-4aee-8093-f0e80371be03", "value": "5d784d3ca02ab0015b028f34aa54bc8c50db39f9671dc787bc2a84f0987043b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc654d60-3f52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976107, "uuid": "c713ba71-e989-45a9-a3dc-ae3d86cb4149", "comment": "Malware payload (Mirai)", "value": "c38d8ffa0e150799c82ffe64cca91c35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976107, "uuid": "be1f7f9c-e091-4f6d-90fb-ce462de4b649", "comment": "Malware payload (Mirai)", "value": "5d83cddfef38d9ddc026c17ec2e0b7167e083661ad01be1d3f70c27880f5b5b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976107, "uuid": "87df0100-593c-43d2-baad-bed5fb353af1", "comment": "Malware payload (Mirai)", "value": "74e46ebad455cb06378efe5b0d84383892d1cfbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976107, "uuid": "c5b449d2-1188-4b31-ac75-a5155aef339a", "comment": "Malware payload (Mirai)", "value": "b1b8b5498aa8e81c614821f48869bcc7f3a5e45e347a918199e396752a81e9b58a41c54abaf0adc102734a0c8bfcac7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976107, "uuid": "7b521eb8-518f-4f06-a5a1-c3a81b9d7759", "value": "T1C9D31945F8515F23C6D622BBFB5E428D3B2A17D8D2EE7203D9255F20378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976107, "uuid": "034233a0-6d2f-4c70-8b42-450ec6abfdf2", "value": "3072:aVLAFHeiitU8SlGZ24d/usuh0ysXarzW:aV0WKlgI4dGsuCyKarz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976107, "uuid": "b5778e43-9797-4b26-9c48-5bc0a6216c78", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976107, "uuid": "dc4df174-52d2-4c94-a556-d3b75c141282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976107, "uuid": "cfc8af0e-aa1c-4044-882c-b9c2ae593d84", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24575b24-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976174, "uuid": "a8b4b374-964d-4fdc-910e-d8f58e4ae77a", "comment": "Malware payload (Mirai)", "value": "e3d70416c6b80e1a5ff7033886eee189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976174, "uuid": "473adcbf-1ea8-401f-9d4b-44109d00f274", "comment": "Malware payload (Mirai)", "value": "5d91f13b1f639ed9b886b4aa387ac547404b4bd2062d7b205687b8de281b7539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976174, "uuid": "537b43fe-6074-4fe9-8671-099c41598e26", "comment": "Malware payload (Mirai)", "value": "3f7792f3334dec15e7fb63e049bafeb7831b6fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976174, "uuid": "56ac8c72-f862-4b83-a4f3-b61bb42fa64b", "comment": "Malware payload (Mirai)", "value": "c846884c6f34a0d53af4b3577e31a7d70a278463d2b6d0bf8f53a1b189f23feb47d7670473a1f492ad49eaafbbb99954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976174, "uuid": "3ca9a3fa-46e5-43f4-97e7-ddf61ae1f413", "value": "T170331A51B8C26627C2D013BAF6AE968E373073E8D2CF3227DD611B113A8552F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976174, "uuid": "46c8e9b0-3a04-42f9-8c65-cc7112eb5806", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYiSF4Xgt2FgNJwJZY10Ux:MX2R3ZNiwaAFz20eOaYiSFGJa100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976174, "uuid": "a4ae672f-d34c-4e07-a87a-70c89ae7271b", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976174, "uuid": "f9be2b85-9340-4026-8e96-dfa55c3d2b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976174, "uuid": "4c7a69f7-3a2e-4ac7-a7b8-42148153790c", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb2b9e-3eae-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776905401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905401, "uuid": "45c682ba-b7bc-48f3-bb34-09ce4bdde6ba", "comment": "Malware payload (PhantomStealer)", "value": "2c7bc15f7e62914f244b3a5d52bd7e6c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905401, "uuid": "a3ce32ac-782c-49bf-9a3b-1b61b3d9e9cb", "comment": "Malware payload (PhantomStealer)", "value": "5ea1b893a50542c7665f96c0bd657df895b270bb7378ac33d00c3f2974834fe7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905401, "uuid": "174525e3-d422-4a5a-894e-c0f5261ebac4", "comment": "Malware payload (PhantomStealer)", "value": "35cdcf2e83806830ad8a8376e41dcd72ba146b82", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905401, "uuid": "26ba9f0d-1755-4c88-869f-3efc17c2032e", "comment": "Malware payload (PhantomStealer)", "value": "e452ace08c79f1ee3f098cad866e486c1ed7a0524ef2a327a25c96ebc490b7e5bdba3c096220ac653d5907464bcff4fd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905401, "uuid": "9cc04f05-3e38-44d0-8695-69df5d25690b", "value": "T13C6502168CD46FB98FAC562D50FE261E63A046DF401B79CADB33BD4A9FBB941010B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905401, "uuid": "39c38445-0f84-43eb-ac56-ecec13ab7e1f", "value": "24576:Q9b4NhFeyTRUc8/hq/GnrKGUvUaWIxRL15i:OKeQxWCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776905401, "uuid": "971d5d30-841d-4c8c-8efa-817d5ca0fb6e", "value": 1413779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776905401, "uuid": "7b0ee22b-d5d3-4b2b-a03d-72ac8ba493ab", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905401, "uuid": "9f50cefb-28cd-4386-82c7-a6d597252ed5", "value": "RFQ_Scan_Doc_PO#_NB400_Materials_Tech_Details_DD7Y00_Order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f26ab2-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976157, "uuid": "3a457a67-2604-418f-bf23-18ab8c82e2bb", "comment": "Malware payload (Mirai)", "value": "0ceb1f4b6815f8d2e96a34367ef63d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976157, "uuid": "fc16d5a9-3a9d-449e-b9e7-2cb2498d3198", "comment": "Malware payload (Mirai)", "value": "5ec33cc78fe1c481f0a38563ef71d215e9a7a570540aa417a8192ff65bed053a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976157, "uuid": "dc021073-d866-4714-b218-afa1b9aa91ac", "comment": "Malware payload (Mirai)", "value": "e1ada6c23a015e7a926b06fec1a3109c2a3db1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976157, "uuid": "a6fdf537-2419-4215-9af2-5c029a620289", "comment": "Malware payload (Mirai)", "value": "4a82787f081bb352d071f0d7eb9c9d75c83014b1831c8bd7808e9d22e5d937c62324ac3919802b45ed881404df4a61fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976157, "uuid": "e30ee461-0ea1-493c-a70c-bb4b51a89891", "value": "T1A6D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976157, "uuid": "5419d949-3eac-4f39-a3c1-d6d80ae56713", "value": "3072:BxioDMQI5nr5aO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5rcnt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976157, "uuid": "32aef427-1da0-4af8-bbf6-e5ef65b1bdf0", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976157, "uuid": "78344635-1b45-41fb-a2bb-043d2fc85601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976157, "uuid": "73a5951a-e902-4395-bea1-56f58457419b", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fd1b79-3f1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776952820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952820, "uuid": "14a53659-9895-4a5a-8604-1b29d4682d34", "comment": "Malware payload", "value": "dd4172f801fed5d1013b2f4495e834a8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952820, "uuid": "ced13f9f-f37a-434d-91d9-8e9ba84ca600", "comment": "Malware payload", "value": "5fafe794830f1c0c8de5900067274062fe29b0be50e84d13f2d719a83d84b685", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952820, "uuid": "c5b29a7f-6207-4707-80c2-e265b6fb0225", "comment": "Malware payload", "value": "e1469f4962f1f5e3342d277f414ef75e3950e6cf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952820, "uuid": "35836ed5-e722-4f44-8bd6-681238bb57c3", "comment": "Malware payload", "value": "03d0964da4a3f47622bdac0a5874ee06f72ff141bdedb093cc0b5bf026f6a298654c6e5a4213e0e17c40c20816dfa132", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952820, "uuid": "92d185ed-c169-4864-b9c9-da81dd0a2fd0", "value": "T1CFC25B4AB641D332C8860B364A4BA7E88F3AEC089F5725067BCB739D2D725D125F75E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952820, "uuid": "d67d46c6-83d3-415d-b216-bb4dadced929", "value": "384:Vwpre8Wvrfo19X4ZBjqDri6bPs+K4sDO8LRMey3M5JC0ioXnpFqNoMG+OaSLg0uI:eg83ZVx7sDPKeWMbCTnN/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776952820, "uuid": "ebaa550a-543d-4f9a-add2-68b749b48a21", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776952820, "uuid": "23962200-fe0b-4572-aa05-aee67e216d4c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952820, "uuid": "5cf9fe96-009c-4f22-90cc-43a42cc95ba3", "value": "Autoruns.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9a3573-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776927736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927736, "uuid": "db09b1ab-c7ce-4b01-b288-14c8e7946fa8", "comment": "Malware payload (Phorpiex)", "value": "a61e39f8eae5b814bdb310851439db19", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927736, "uuid": "94ab303e-8231-472e-8532-51bdf05c2f15", "comment": "Malware payload (Phorpiex)", "value": "5fb0a8edd0ece76b52b8bb32dd9777255585237c511a54d2bc3875796db5c361", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927736, "uuid": "f5711697-ed37-4b39-9791-a4a2cf116730", "comment": "Malware payload (Phorpiex)", "value": "c222380e542ffb4407f238747d6de204d9889659", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927736, "uuid": "a70cc1b6-55e0-4237-a4f3-e1a272386e13", "comment": "Malware payload (Phorpiex)", "value": "0f94bbc0e58dacb3e377486e7191a831b8a4497606257fc4edb421a5b9a10f4b1e6b51afa1ac4d1435b919ee745b42a2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927736, "uuid": "673f120c-f8d7-434e-b1a3-101dcb317694", "value": "T19B823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927736, "uuid": "cc01d058-0248-4e77-a930-068b62a0a4b9", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927736, "uuid": "d41ade1f-247a-43ea-a062-9da4afe526c0", "value": "384:gI78VGQic1Kwzw077u9NHu/gBhav8U9cL:xAo0769Zha0Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927736, "uuid": "df2647a1-35d0-4366-b704-7d248e26bf7a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927736, "uuid": "21104f28-2d8a-45f8-a2bb-fe4e4f7b9805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927736, "uuid": "0e043561-0ff5-4f9b-b31b-993b25291fad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3f76c8-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923093, "uuid": "377a5315-0a77-4bdd-8e0c-e5e2b52c5df6", "comment": "Malware payload (Mirai)", "value": "f790edea55d2b96858053ab70a43c4c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923093, "uuid": "5abeb8c1-8671-41f2-b725-51d2458fa9de", "comment": "Malware payload (Mirai)", "value": "6062a1d54773eaa3933b94cee181fabf5e1f29e89ef6c772facddd7b4d5b1cac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923093, "uuid": "6d2ede3a-b642-427a-9a92-2c4361ae475a", "comment": "Malware payload (Mirai)", "value": "f63cc92543616ffea0a5b68424490d877c5afdd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923093, "uuid": "252a72d0-91c5-45d3-bfa8-3e292561e124", "comment": "Malware payload (Mirai)", "value": "e8ecc529cf6dd62ea8ae483f138b2e1cdbebbbdeec341d97d77638b3541870d8e07797fe017e271d8264416f60e34774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923093, "uuid": "4bf3072f-ecd0-408c-a534-8df046c8121a", "value": "T10DC4CF67F9225C43C4E3963E15A7C2755267D24A1792E302A30FF9BD3AC63394B1A3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923093, "uuid": "27954e29-6fde-438a-89c8-0a5409daa593", "value": "12288:n6ZvgsW9Mz2oq1zS7gRoMayXURygpQ33OosvRKKIFBpG6Ie:9CczS7GhezvRKKITpG6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923093, "uuid": "739ff514-aa1e-4596-9b95-002737040eef", "value": 571680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923093, "uuid": "96a39ce0-5745-473e-b2d3-8173353a40c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923093, "uuid": "594ad72a-f786-4d4d-adda-32845b2b9a58", "value": "svc.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df01a63-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928221, "uuid": "b993e520-c779-46e3-9381-8d5504ab0ab3", "comment": "Malware payload", "value": "f070570b12073dd2163155338182a255", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928221, "uuid": "b78d72b9-e6b8-4140-ad2c-35181585b2d4", "comment": "Malware payload", "value": "612ee6c54231e0c4343bc2210fd43992d455635e744437eaccbefecd3d1f9b9d", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928221, "uuid": "69ed2886-849a-4ae9-b7c8-8355ffed8502", "comment": "Malware payload", "value": "20f7a1b6c1e4480372f10151f5a3af3fb6616b6b", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928221, "uuid": "e798fe48-7273-4ba6-b2a7-393c69523afc", "comment": "Malware payload", "value": "c53ba06bfdd8c332e7a1b88d37fbb198dd797d5564a55747a783b1e090da7d0ac01b9c50503a161ee3ca19641f6d664c", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928221, "uuid": "8019e04e-f189-40e3-8fd5-421ea37c64ba", "value": "T16827230A0EFDAF9BC57824DC451FAE5C255F870864B82FD6027DB9A5E42FB1403DA236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928221, "uuid": "4a578034-36b8-42b9-b945-ed4b1944fa2e", "value": "49152:r40UmO40Ums40Umm40UmD40Umn40Um140Umg40Umj40UmQ40UmS40Um140Umka2k:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928221, "uuid": "d6a1e838-0093-4999-b7bf-fcc68426cd61", "value": 21131474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928221, "uuid": "fe72be29-466c-479b-9d97-713a3b1a821b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928221, "uuid": "c3f96485-3cfd-4c1a-b85d-8bdec464ae6d", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e205149f-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927960, "uuid": "e7c2efca-bcea-4b6c-8932-a54a71663a63", "comment": "Malware payload", "value": "189bd2bb5d4086d3bcb71de37c4b5089", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927960, "uuid": "eef263b0-25e0-4c30-9104-f564587ef029", "comment": "Malware payload", "value": "61c4885a11f0daa436cf9662a3bb1ff1bcb9f60c43b318849183cc8dbd9cefb2", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927960, "uuid": "028a6252-522c-4c57-a5cf-11b7630533ea", "comment": "Malware payload", "value": "b03057f92010f871e86456a4ac2559a4e4bd5db7", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927960, "uuid": "d0535355-e32a-47d6-b482-6785af1eea4c", "comment": "Malware payload", "value": "4c2113f6b5010b822f5e56e54545b04ef3e3ba5c34f710754edac177cb0272665a9327f8499849854f7180a90e704344", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927960, "uuid": "a25147e1-3545-49f6-8fab-33c449a0323a", "value": "T1C62723184F624DFF4B9C091F28BEC90C42F88EC84594EBA5BFD96CA2C24DFA1971D159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927960, "uuid": "acd1f6ee-f08a-493c-ac53-5e3808edb1b3", "value": "49152:8yeycydy1y2y8y1yTyjyjyZy87rrs1PycypyjyQyq7rrs1KyvygyOy2yyylyVy4U:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927960, "uuid": "47bc2215-c5cd-45dc-8333-2805bbad2368", "value": 21851522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927960, "uuid": "50f7e4a7-00fe-4f8b-ae5b-d741b37d5cf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927960, "uuid": "50e127cd-7b1a-43a4-9fea-1f23bac837e2", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7293736c-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963421, "uuid": "1d793813-4ad7-416b-90cd-dd2e4b187434", "comment": "Malware payload (Mirai)", "value": "71be3fc27c33dc9d945ced275ea715e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963421, "uuid": "60b30ab6-1c7d-4df6-8c4e-d9475aeb2e4b", "comment": "Malware payload (Mirai)", "value": "61fd3ee11537b9e82d2c8e35593b6f4cd66707775f481cc4c23d8dc9e0b6ebc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963421, "uuid": "503c09ae-df46-4643-afc1-ae3971b6100b", "comment": "Malware payload (Mirai)", "value": "fe80e01e80619d40f9cecfeeb2c3c76ccbc8e351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963421, "uuid": "03e33b65-f86e-4399-9b90-f37e84acd2b9", "comment": "Malware payload (Mirai)", "value": "02ecadbc53a8d3aded7acd9695a5e32da561600b23fa85d264438904fc76359d5e6005d65b145d2d6d9fb2a74e3f52f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963421, "uuid": "7ac6db6d-f242-4a78-b918-bd71e688589e", "value": "T1AE3338C0E64BE8F5FC5646742077E7329B73F93A0029DAC6D368A533A992605E6473CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963421, "uuid": "b219c237-0415-4c8f-98f9-7ea995cddb35", "value": "1536:K9pCH13EPvQ7PKVjC6ymlkNspmXmZGb+RjwLS3:rH10PvQ7EjymlE4pZGylwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963421, "uuid": "491730b8-90fb-4ee4-997c-907e3dc01257", "value": 54352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963421, "uuid": "4801c05b-be4e-45e7-92f6-a5f85630a48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963421, "uuid": "f1fa8d51-5e90-4196-89fb-c9cc3d15ba14", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb518e8a-3ef2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934874, "uuid": "4a38f4b7-cd5a-4c47-875f-3a04493a74e2", "comment": "Malware payload", "value": "eb7417e67c3e9dedb6422f6a8be5326e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934874, "uuid": "5c15398a-1544-4c91-be50-9a9b5233b85d", "comment": "Malware payload", "value": "629db57b96d6e965401d866f895d86c542efe344b3d489630a6ec09d643add76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934874, "uuid": "3d19dadb-7c18-487b-b0be-7541769226f1", "comment": "Malware payload", "value": "29302efdd9ac6f19c4ce2d48c85e15283fedab0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934874, "uuid": "d4338bd7-7656-45b0-b391-548bac91e55c", "comment": "Malware payload", "value": "86b51ea709c3b3c7b5674abc1ba1b67cdf36892a15b6bbbfd56da4182aa497ad06c0090ef4873971f6bb12de8706e155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934874, "uuid": "b828a256-4d0a-4f79-b110-8a6df48dd82e", "value": "T150E4E657A89550F4C1FEE134C666A213BDA13499073827E72FA147F10B26FF86A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934874, "uuid": "1fcd1f19-82fc-4cd0-8a0a-f96a3cc343de", "value": "12288:ciZLBtBn77RD3w2AJK7g9rb/TBvO90dL3BmAFd4A64nsfJEU:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934874, "uuid": "710ef018-c9b5-4d4d-b010-c5cbf94455b9", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934874, "uuid": "9b7a9487-05ac-4533-9318-38dd1bfc8da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934874, "uuid": "bf557445-c496-4ac0-8655-7b0234444d8c", "value": "629db57b96d6e965401d866f895d86c542efe344b3d489630a6ec09d643add76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d24ee4-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987585, "uuid": "6e0a7d4e-5146-4211-b95d-559efe3dd634", "comment": "Malware payload", "value": "b851f1488f5f0961077630bae1df687b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987585, "uuid": "d966c558-21ba-411a-8c47-ee146c3ff2e3", "comment": "Malware payload", "value": "62bbbeea6d1317e8446fdbc2058ee2ff8d096bee3113526dfcec9821723c9a83", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987585, "uuid": "a0a4cf0d-1ad1-4c18-b046-e14fb41b8684", "comment": "Malware payload", "value": "837691161e7506d0637eb7bc4e610768c944b267", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987585, "uuid": "d7c9e1d4-7647-4681-8796-4bd9e63edf02", "comment": "Malware payload", "value": "44f4553352bc5c24338552503fb54f1c4d42cd2217203a0b0f9f626f84d3276b6b24135080eab953b16a7b1b2e2a63f2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987585, "uuid": "f53d68aa-5c95-4434-a00b-dc126df6eaf9", "value": "T190F00201A31AC2E71212A2A604E4D55CE16049A46AF4B70A5510C84F075B87FF6CD1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987585, "uuid": "f5c59a7d-2d76-43a4-b043-b88cf05a7d5a", "value": "12:mqz92G2skV9vWdWjnbT4EXtyH4+CmRi+ChRi+C4i+2A2p9:l952zTAInbTdXtBmRwhRw42A2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987585, "uuid": "e77e7a8d-353a-4bb0-affd-234b2f84aefc", "value": 622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987585, "uuid": "72e2a9d4-f07e-46d5-9315-77aaa06249eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987585, "uuid": "e9a11fdc-0cfa-42ba-8b27-84fadce0e386", "value": "gqJAhCTdxMg656.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fe1b79-3f1c-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1776952879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952879, "uuid": "da774783-9e87-4cae-824c-475c762277a1", "comment": "Malware payload (KongTuke)", "value": "d733e27692166cb4a69b06a9d6a0b8a4", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952879, "uuid": "c5907ca5-5af1-416e-b0c4-32d04c735b2f", "comment": "Malware payload (KongTuke)", "value": "6316e735a026e0421e4ee274e36594bb510afbf8798e767f6a082d827b5082a0", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952879, "uuid": "e833db42-ce48-417f-b8c3-f95e42e37d2a", "comment": "Malware payload (KongTuke)", "value": "cac7f5814d20afe4d59c6e4b9aa50eb638a4ec54", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952879, "uuid": "336171b4-3051-4cb9-9d60-05e5c850637d", "comment": "Malware payload (KongTuke)", "value": "677bb980faaeae188d0a64bab27523e46549159242e65e95be09b399ad7cd7cff4ae392314952e26def8a510a4d1daed", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952879, "uuid": "d8cb20e5-e54b-439b-853f-4648b2aee34e", "value": "T12DE0120070AFAC77566134969FD33D8DB5161393996AFE560BA90D0202D6B4C61CE6F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952879, "uuid": "d374420f-8abb-4cd7-9dab-8caff6b37435", "value": "12:fhKH+LN9LTFHYS1H+LN9scW8wH+LN9scCH+LN9LxH+LN9X:fEejLT1V1ejsH8wejsJejLxejX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776952879, "uuid": "95991185-24e8-4eea-8ac2-3972e1c95ec2", "value": 386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776952879, "uuid": "52249cca-b0f3-4304-9123-2a3db0e48be2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952879, "uuid": "3e89a470-ac4b-4a96-82de-f71ed8e5c917", "value": "jh038x18gy9.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a64bc-3f0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776947037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947037, "uuid": "53fc4ec5-eeea-4db2-9a30-ad2fd01f03c6", "comment": "Malware payload (Smoke Loader)", "value": "93a1a33e92f6d4684f231012f1d5872c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947037, "uuid": "92f743da-2376-47b4-bdfa-09fd5b98fcc9", "comment": "Malware payload (Smoke Loader)", "value": "634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947037, "uuid": "0a843c04-3e71-4cca-a51c-de75692e5318", "comment": "Malware payload (Smoke Loader)", "value": "888dbcd7033ff84ead51d2e7d5397f0e9632ef96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947037, "uuid": "c25346da-69ac-4207-bffa-2be1a4025155", "comment": "Malware payload (Smoke Loader)", "value": "ea59bfc90ce7b41fe4ad96f26716a12202c54e3122b401fa426ed547b9b284c66ca63d2be6e7fb1bf7475cd06a5155d2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947037, "uuid": "7099f6d6-0725-4eaf-8a05-de1ee15a3299", "value": "T118955B41789105BDC499B73248F23682BA36F8190B3677D32F91AA783F37BD0197674A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947037, "uuid": "0318ac3f-7637-4c0e-96ad-141dd3ad801b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947037, "uuid": "59f531e7-dc69-443f-9c63-6fb28c8ceb66", "value": "49152:bPE+OIaSlC05Alg0PBnQLPncyrkkgI6gNnn9IOa5:bPEkR45Ee5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776947037, "uuid": "be3fca5f-9636-4077-b5c8-ddfeee2f7f49", "value": 1967816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776947037, "uuid": "57583583-c392-4f24-b66c-6988ead12327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947037, "uuid": "6c9433b1-15d3-4770-9696-0c8d87d1756e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d1ff56-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982170, "uuid": "d04b5210-590d-43e2-92b0-4400cbff15b2", "comment": "Malware payload (Mirai)", "value": "ad9e3d0923e4921949a382ee120fa95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982170, "uuid": "ac7858f7-362a-4092-a8c2-392a0d2aebd2", "comment": "Malware payload (Mirai)", "value": "63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982170, "uuid": "df5fc192-4812-4399-a650-3d48f4d37202", "comment": "Malware payload (Mirai)", "value": "3b6890741ac6b0aed2077713aa35329b772edace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982170, "uuid": "05e168cd-5af5-47e4-8670-6767110c6eb5", "comment": "Malware payload (Mirai)", "value": "d270e2db52cfe83fdd13114d2c4aa3e0cce0469931a5f90c98eac3d6ab4b7d08d360ce1684c5bbeab2cf66400e03ce29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982170, "uuid": "771caeca-ba2e-4877-a35e-149b6c5a7997", "value": "T148F3885E6E238F7EF668873047F74E25976823D623E1D684E1ACC1145F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982170, "uuid": "ccc3243d-d567-4c80-9d5f-9c38319303a1", "value": "1536:VXK95pZAla7e1fHPOix3E4+0hIxQgAai67kUJSMqXGLeXv3/lwqgTPnKWWO306xB:VXKrJ7vAaiMkySPXG0v37oRW36xALls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982170, "uuid": "edccabbb-ce53-4e4f-8653-d431863732a3", "value": 169648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982170, "uuid": "a418b4fd-a2ad-4a5b-9141-cb0f88ea7431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982170, "uuid": "931cf551-122a-4fd2-a476-ea5cacf9483e", "value": "concakhbtandhuy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f874c725-3ece-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1776919407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919407, "uuid": "57b63c48-1022-46fa-8d33-ab029e5bbe61", "comment": "Malware payload (ArkeiStealer)", "value": "9a4decbde116b8722c39bee308971087", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919407, "uuid": "e2d4ab0b-c7c6-4d91-bd22-cc5dba27f997", "comment": "Malware payload (ArkeiStealer)", "value": "6379ae703811a9d8e65df53cb8cdc2902aae5af918ed8fe300e379360d4cfa99", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919407, "uuid": "aa394e94-3f0b-4a0b-b365-92e227f323e5", "comment": "Malware payload (ArkeiStealer)", "value": "f538bfbd923b05402ac0322d87fdfd08b44d5c2c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919407, "uuid": "26425ae9-2d2b-407c-ad07-373a4a2e6da3", "comment": "Malware payload (ArkeiStealer)", "value": "3dbf3d5d52ff73c1ae0edb9b12719803384ee6182b5ae4b0983429141ff5ad7e8f3be462d2556d4704d684a59c98b371", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919407, "uuid": "dee2542a-28e1-48d9-854a-df804e7d08e6", "value": "T11D473302B225B9E8C1BECDB1E36DE1E111A65CDC8134A5EEFB145B9EFF0B604159E078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919407, "uuid": "f685d92b-523e-4643-8fe4-1aef63a79361", "value": "3483902c14f87d3d75259121994474b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919407, "uuid": "0ecffd61-0dfd-4038-9d75-f5498286c8c8", "value": "393216:SBa2ydUNXx6zi9c6RYEIBFpuYqFC1nc3UDWriyUx9No/gPyBgbyK07kDXzCntyKn:Ca7d4B3cgIjYYYQQDU32jY07uj7KPzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776919407, "uuid": "95b34467-fb8d-43ff-99db-0e1e3627a591", "value": 24627491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776919407, "uuid": "d4e028fd-e861-4cb0-bd3a-98a8b33ce6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919407, "uuid": "cd3f3d17-a8b0-44b8-be42-5c5038f78a53", "value": "Quick_protected_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e274c625-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938268, "uuid": "6275559f-0519-4473-8e30-1ba6ea0d29cd", "comment": "Malware payload", "value": "5a4996dda4d62dcc90c7a8bee4cfe559", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938268, "uuid": "57c970f6-662c-4855-9c09-38bd77316c25", "comment": "Malware payload", "value": "63c7dee4e18fea734aacd277380af38ea9bf61bdcf505e917d1adafac87fddc1", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938268, "uuid": "963b322e-ceb5-4ca2-a217-dbbb61e31b51", "comment": "Malware payload", "value": "b96f1617a724481902f362a042cf2504cebfbd26", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938268, "uuid": "32834645-ab1b-4aa0-aeb3-8dc5d00435d4", "comment": "Malware payload", "value": "b92042da607232d117893c13d384fd5c6bccc8414f99e345ca4c08b82c002659310f409faf398d960807e61797e9c376", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938268, "uuid": "4fde3589-b04a-43d3-95ca-d5328a32ead6", "value": "T190E7334370580627FA9DB679E50EF628DF327D058C70A18F7E9C85A0110FBAF19A54BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938268, "uuid": "d1edf04b-3350-47db-88aa-8b1d8365603e", "value": "1572864:zy6Rc7lTI2Dys2wzzRqnlfkZDvJfF4Uuu4K8wXq95AGoafcQRbiPdGLl:zy6UTI2Dy5SzRqlIDlf4K8w8RbiYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938268, "uuid": "edd57d12-02a6-422f-ab63-1a10998a1a5d", "value": 67827992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938268, "uuid": "e2c0a27f-7a1f-4e6a-8c83-6dd7a2fd6d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938268, "uuid": "798c031b-55e9-40db-8fe9-5fe7b8ab4955", "value": "63c7dee4e18fea734aacd277380af38ea9bf61bdcf505e917d1adafac87fddc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c213ed-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924387, "uuid": "a6aea7f8-6a06-4174-a22b-a4a88ffcf54f", "comment": "Malware payload (Mirai)", "value": "e44efc9aba985364d9a80a261f9dac4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924387, "uuid": "d37db280-863f-4fb7-ac14-b6b94bd8e5dc", "comment": "Malware payload (Mirai)", "value": "6463214cc5012bdfd2dddf506b2f0ef3d3646892b16ab7e23e920a67a2e1619d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924387, "uuid": "ee4d4131-e991-4b3c-a2b8-8555d03fd15a", "comment": "Malware payload (Mirai)", "value": "74a0def4be49d4541840b93dbc08fde1a7f48bee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924387, "uuid": "ddf110c4-1bfd-4a6a-87f2-21e1c0092361", "comment": "Malware payload (Mirai)", "value": "d8113bde7f55899493b43b74df0e1a2aa109440cf322427571dc1aedc72789c02d3bfc52b999a8d4380988a475789789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924387, "uuid": "23cda842-5ada-4f6e-b7ea-e68ffe92a6d0", "value": "T18E343913B89080FEC496C2789FEFA136DA26B84DA034B12E27957F163D59F30AB5D741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924387, "uuid": "3813f0a1-425e-46af-8357-9413bdcec1ab", "value": "3072:TjZC3bdk2oT5dW+CNYE5/2ClH/mXkl48qdtrkG45ZcUJRahp257bA+tQk9kPfu/r:ULiF5dW+CN35/XlfB4D0T5WEt7b+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924387, "uuid": "8669e70b-74cc-4594-b3f0-bcfb6163444b", "value": 239304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924387, "uuid": "c4f12a5c-8895-47b5-917a-92a68dd6aa06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924387, "uuid": "680d8cda-c2e7-41b8-bfb9-9083748a4ec4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3721439c-3eef-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776933256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933256, "uuid": "12c1cae7-c698-4db6-a476-bdd9ba081c20", "comment": "Malware payload (RustyStealer)", "value": "e0235c2e600b15d363c793932746346f", "object_relation": "md5", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933256, "uuid": "e738b87f-d69e-43e5-b16a-d2325d1a99e9", "comment": "Malware payload (RustyStealer)", "value": "6466ea45ecd810d2480a593a0c144d69cfb3296f15e89ce282d0a279416c73c8", "object_relation": "sha256", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933256, "uuid": "b1c83b93-8c32-400a-82e9-c46b89cda711", "comment": "Malware payload (RustyStealer)", "value": "8585fc85580e9fbb5245e77d92d032f095acedf5", "object_relation": "sha1", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933256, "uuid": "a1fce801-3901-4179-9196-cf2efe48963c", "comment": "Malware payload (RustyStealer)", "value": "ce3cde2e934fb41c566134d8f8819b2a15a8198194dbfc5466bf81553e56788377789b998def81315499329922c73893", "object_relation": "sha3-384", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933256, "uuid": "6f7b12ed-a48d-438d-822e-9729343f7712", "value": "T136365C037F9A49E9C09AC874C346CA674F2230CB0B35F6AF45D515292F6EAB55F2D328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933256, "uuid": "1acfb83b-2b53-423e-b56c-424f5b777ddb", "value": "d848303dacda60ebd7d6f59a0152df0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933256, "uuid": "7127cb22-8714-4760-ad35-572696b1774c", "value": "49152:OHLiZp93qulowURX5MyCKvWzC3CZALS+G/6zhYhoe4Cp/CCTAtn3ch6maHD/WDTe:3z+pZY30Zch6/85ZYDBYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933256, "uuid": "094c4a63-b25b-4302-9923-4eae6ec20bee", "value": 4966904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933256, "uuid": "fe197b42-21e6-48cb-a240-8eb3d04ee47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933256, "uuid": "1dcc01a4-4b67-4894-a3fa-3edeb6067244", "value": "6466ea45ecd810d2480a593a0c144d69cfb3296f15e89ce282d0a279416c73c8(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bf6435-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976127, "uuid": "9d5aec9d-7068-4167-ad32-5189b93df9db", "comment": "Malware payload (Mirai)", "value": "ab85c79f77b94145a1cc97f6e1d02218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976127, "uuid": "68f675a4-b59b-42eb-b1d9-05a3490d1e17", "comment": "Malware payload (Mirai)", "value": "64af6e717b2c842380f45184379684d73c194bf9e8448662ca884237fc3c4470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976127, "uuid": "f85feef7-d9fa-4da8-9224-239e9caf7aa7", "comment": "Malware payload (Mirai)", "value": "f2377bc7b79b8990bd184ee7b9a909a267ed6d3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976127, "uuid": "d606f569-ee56-4177-839e-fad5a034d234", "comment": "Malware payload (Mirai)", "value": "dacf449f66835f4578bbccc1d066c201fc59a504ae4d0ab19709b85a15c4a68adc62509c9f3914505d3b5ab90930ef3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976127, "uuid": "c62dedba-f0f3-4cb7-8a6a-f53110280491", "value": "T11504A91D6E228F6DF768863047F79E259B5823D523D1E684E2ACC2141F6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976127, "uuid": "6d46e492-3dcf-427b-995b-8a7c0410e3a4", "value": "3072:AJ9X+sQcT+02S893Zyk7IF5BelSAL88f0:K5XrT+npZ9keLLBf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976127, "uuid": "666b5d9f-192b-4049-8075-d0298cfe0a6e", "value": 181928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976127, "uuid": "1870ff27-c2e0-4091-b9ee-8bdf4a2c83d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976127, "uuid": "73a967d7-5bc5-4466-b645-550ebca52297", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb8d122-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935096, "uuid": "efc2d042-135d-464a-9f95-7f365ebfbded", "comment": "Malware payload", "value": "624fef07ec4c14ad4907d77fe4095610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935096, "uuid": "2d40fe23-6573-4f89-a70b-d6302e767b97", "comment": "Malware payload", "value": "64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935096, "uuid": "50a82ef5-2d69-4df7-ac73-0262e4ef426d", "comment": "Malware payload", "value": "2b1adbe3c4435d049053c8954f5d3f6aa3922a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935096, "uuid": "a57c5e8c-a57b-45db-b16b-e1ecfd06c210", "comment": "Malware payload", "value": "bf1450cfafef5496c89182a30b209104c1381d1027f625daf7dd32886d10bec0b36a48958e0ded9713704bcb335b1776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935096, "uuid": "3869bdf4-8ad5-4ddf-8fe6-80209e192e68", "value": "T1BD52875A77DDCBBAD0C6E13085B7B94FF8F1DD916A4252492664019F0CAA3C8F3D9B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935096, "uuid": "c2487551-94e8-4b18-b1c2-f55ea07a17f1", "value": "48:iRnjhFs2Gls6lw/H3G3iGl7+wfEUvLWmeG2+u2Gu+4ZjtXlaDTA7P167CNCU3f7O:2nIsK3rXW22+G+t1p40C6DQXAOjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935096, "uuid": "27c7c137-10a4-465e-8ce2-ad4f17f8bc32", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935096, "uuid": "7b605ce0-8717-4b53-8d05-e9aa261d6295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935096, "uuid": "acb95fcf-bb8c-4f47-b5bc-a9cff08ee20c", "value": "64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83789e24-3edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925653, "uuid": "a2bd9a84-38c0-442c-a9ca-1de11ee1fa01", "comment": "Malware payload", "value": "3207bd640e7c4fc886b8cfa16c7b64fb", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925653, "uuid": "b0b52a25-30ee-49bc-bde4-979494fc920a", "comment": "Malware payload", "value": "6504e90f463974d97e7ebf401d4c1a557ed6c06bae143718d6f74b5f9ae50952", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925653, "uuid": "9fd304e9-eef8-42b2-96f4-10acd267e07c", "comment": "Malware payload", "value": "b7ed6cc6a658a641ee6f9222a40c5412dea2a459", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925653, "uuid": "4a3918bf-7f5c-4f8b-8712-91c03a0b9b92", "comment": "Malware payload", "value": "da9828c810216e732da21800975ac5ca22b8f59de137e6cdf2a3042143cea0a5c6003d92340c5b3fde739deff40ae073", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925653, "uuid": "4402438d-b5ae-4bff-b713-281ebdd40c86", "value": "T195333E31F7EBEBD89B07994E847E3C77570422C122D492A754674E869648F3A26037BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925653, "uuid": "e82e3c33-a173-4334-894e-92cfe264f268", "value": "192:oelGV4IyXu9G4oknDyvasgYUA6QlA8CAFS2WxxzbCyLLxRyhyopq1XL3u7x:ohcEG4oknOvaJV8K2AzbCynxRyk8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925653, "uuid": "fab77ba9-ce05-43ed-867f-4d2d0db8fad8", "value": 53703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925653, "uuid": "7e62dd9e-905f-4a10-9354-3b2a359d2ffd", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925653, "uuid": "3eb499e3-661e-4a5f-bba8-bad76ae00baf", "value": "6504e90f463974d97e7ebf401d4c1a557ed6c06bae143718d6f74b5f9ae50952.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87093fd4-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935108, "uuid": "757bf0b0-d35f-455c-bc59-9b846a37a0df", "comment": "Malware payload", "value": "a7012d46ab1f5fba4ff81f442848237d", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935108, "uuid": "fff97ef9-15e5-40aa-9379-8d1bd585ef94", "comment": "Malware payload", "value": "65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935108, "uuid": "67f1de41-9e19-4ab3-8bed-2c630008d6cc", "comment": "Malware payload", "value": "33c8c74294cd9cece97a2158a2533e992c8310bc", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935108, "uuid": "3e2dec19-127e-4aca-bebb-6038de338073", "comment": "Malware payload", "value": "1e0ebab082b9280f27ef24d2ecf394773ee6d8a2b0d825993a17072eed5f1f810987b8e06ee63225e13947167555e553", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935108, "uuid": "26463cdf-5d2f-40b0-a67a-03395c92dc8e", "value": "T122C47E307A461DFF5BA820C248DAC11C563C36B5CA682DE569CB4CE33A0D77627B79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935108, "uuid": "dcfb38f5-1c87-4496-8fc5-eae867fa3d99", "value": "12288:kKcdXKUmOt9KsmpHgwslOpblTWyR6nw0/Ht6:BcdaUL9MoSlVo3/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935108, "uuid": "1c6552b6-db89-4845-9fa6-d09bc6bce50f", "value": 594037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935108, "uuid": "ff6a41db-d9a0-4966-834b-af31a7d40f2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935108, "uuid": "b5fd5b20-d25b-411d-a699-721a2956e609", "value": "65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae82598-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963408, "uuid": "937f8272-c958-4fba-985c-47301458abe9", "comment": "Malware payload (Mirai)", "value": "25d0591605242c27f2d737ab3c8e261a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963408, "uuid": "2591ec47-49a3-4750-8e81-704bed7ae46c", "comment": "Malware payload (Mirai)", "value": "666d8973a9eb59ce672cfd7727371548425da4bd38002c06930f8d867938b13e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963408, "uuid": "49b96ea7-e9e9-4116-86a3-d8ea8cfd82a1", "comment": "Malware payload (Mirai)", "value": "d16e493f29f40792b4bc9071d5e96bf3d1ee0328", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963408, "uuid": "6724d722-71b2-4386-b992-e4b8cfe313fe", "comment": "Malware payload (Mirai)", "value": "79ad16a900739bd1a8951261af498fb4d82adcede37dc1b7a88cb43227514f58a6f696d91a5c7e606483c113a9f6cbfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963408, "uuid": "4ffd4db9-eaec-40f1-8b67-ec3b234255fc", "value": "T15373B81D2E628FADF7A9823447B78F21939C378627E1D685E25CD6001F6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963408, "uuid": "dee87cfe-19c2-4db7-afc2-7bdf5156071a", "value": "1536:uuT16ORJA194fspAuAWbQ9wXMdUBvcXeZg/Z:uuTYO019NjXMdUBvc9/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963408, "uuid": "1df6823e-cb10-4fed-bfed-47450633c06f", "value": 80712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963408, "uuid": "7822851a-1af8-44fd-ba90-7da26d190af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963408, "uuid": "1ee8d54e-f51c-443b-adf3-a2a772825b61", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb735539-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776954094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954094, "uuid": "4389ef49-8fea-4c04-9383-c6971708f5e1", "comment": "Malware payload (ConnectWise)", "value": "dcb53c304b1c87ae8313203372616118", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954094, "uuid": "cf07f9a1-2462-4cd2-a579-aa28ff7facde", "comment": "Malware payload (ConnectWise)", "value": "66d6874b32fe87967b5e7a0771b581d2016591c3d3f46afd53ee24f73547293a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954094, "uuid": "cab0672c-0a5a-484c-a624-645e6ca5cc47", "comment": "Malware payload (ConnectWise)", "value": "14e974f9894de585cca6f281a18db3f6161b8ae0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954094, "uuid": "b7ef0b58-374c-4dc1-9600-ed2225b2fb56", "comment": "Malware payload (ConnectWise)", "value": "440286d5e144072d171f7d428b4eb8a5ad354dadb976308f1212c95a82a7daaa87371964982dddfb0c465dca87b8512a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954094, "uuid": "6df416d5-922f-4381-99c1-55a7a14b364e", "value": "T139D61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954094, "uuid": "ecff097d-c3e9-41ce-8d9f-54ec0dcdbbc1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954094, "uuid": "f2e3655f-40a9-4ad2-bb9c-c7c3db5ef9ec", "value": "393216:cCXvI5MvHx2J+CXvI5MvHx6CXvI5MvHxnCXvI5MvHxM:cZ6HxJZ6Hx6Z6HxnZ6HxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954094, "uuid": "a824723c-b92d-4cfb-a359-63ca3517c6f1", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954094, "uuid": "3fa16fe7-6529-4c9d-80e3-ea9f1e9bb9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954094, "uuid": "e7fdf6a6-b40c-4dc7-b18a-8618275b2038", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fe3bb1-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956667, "uuid": "7472dcbf-8ea9-430c-9e1f-b5f3f147af21", "comment": "Malware payload", "value": "3c0238268ea94638cfe76969ae27e410", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956667, "uuid": "839eec45-ccb8-4d39-9f85-e36d9f41d290", "comment": "Malware payload", "value": "66e6fbff588ac79f90a91a8e4cbf5d1ee81de541194c27888a66315884fdb69d", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956667, "uuid": "6db70072-1eff-4605-938b-2f738530b6a3", "comment": "Malware payload", "value": "3b8d91bac6577097d4571215deb12db3c019223d", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956667, "uuid": "1e20f78a-88fb-4f19-8e4d-7f7e3b0e467e", "comment": "Malware payload", "value": "5e0f958fc8af7b18475bd52d0aaa7cfa7e9377372fe027827907b5a794cf11610d941b072345c6973410e2b97e41694c", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956667, "uuid": "6fa60916-a171-4ca1-a078-32055dbbb01a", "value": "T18D855D03E2A360FDC16FC13487D69B72F53074684134AEAFA2D1C7352A74ED05B5AB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956667, "uuid": "e8fb165b-32f5-4f3d-aa02-532f61cb397f", "value": "8ea2ac051c081c8f14a900919120809a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956667, "uuid": "b3543927-7c1b-497d-947d-4595e534dc33", "value": "24576:1tNbYhB0Tg7z528Rpqi+enRSd7zTbZrVhuEmOtz0CT3d0CjHOcI7hhfGiVSbrDA:faUiz887+enC7zH8EmOtzF36CjuarD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956667, "uuid": "9f7df21a-6049-4098-a794-8e4a0da22afb", "value": 1743872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956667, "uuid": "3eee8af4-9426-4492-af7a-feff7fdd2d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956667, "uuid": "479ca595-eb4b-4f46-ae36-6ddbe875a053", "value": "66e6fbff588ac79f90a91a8e4cbf5d1ee81de541194c27888a66315884fdb69d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a81e841-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776945664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945664, "uuid": "8f3aa2c8-a071-4ef2-85ac-c4f35413b089", "comment": "Malware payload", "value": "a5a6bc76d54c2a22cf1647fd761ca95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945664, "uuid": "2bb61afa-1e52-40a1-8f50-d8d7736984bb", "comment": "Malware payload", "value": "6795b2aec2a3771f6cc02ca11c8f598ce96cea2d11fc5a7c797935b1b7039e19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945664, "uuid": "b8ba3e35-878a-4b33-95b1-f3e3db8c5502", "comment": "Malware payload", "value": "11286e0e19102360a1594335664fa7a12f80666b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945664, "uuid": "08afbac7-aedf-40ce-b78d-828f558af0bb", "comment": "Malware payload", "value": "e0e89976be179ded903e88274d9ec4da421fd7557ff9e72589707e01422015db0cf530707136f9a6e3bdfe30413aed92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945664, "uuid": "711a8737-87b2-4949-8e18-210b96128091", "value": "T143B4835452ED52D3E6BACAFCD87809C78779783F252DEF892CA630CD6524700E460B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945664, "uuid": "211bf5cd-f660-42ae-b1d0-190121863934", "value": "6144:oVxeCyAFDDj6Co/MUqrFBMhGBkqSQIxgErQvaCSgC7qvxYrzdWtcJDJ:eeZSqAtNoQvnCG5EzdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945664, "uuid": "f77101fa-b08f-42be-be59-9f60b208bd37", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945664, "uuid": "63fceb7a-be81-4b85-b6a2-53e249ec2e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945664, "uuid": "a4c8d3f3-6912-4bd1-9323-3e62f4ff1b61", "value": "6795b2aec2a3771f6cc02ca11c8f598ce96cea2d11fc5a7c797935b1b7039e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bf70e9-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972394, "uuid": "1177e9df-f75d-4eb2-a7ba-de6b098b595e", "comment": "Malware payload (Mirai)", "value": "1a1e4257d4a8bdab3b37bbcaad4044f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972394, "uuid": "a71328dc-14d6-455b-8b0b-f500ae41aaaa", "comment": "Malware payload (Mirai)", "value": "67f4a344ca29e3d8e8331697973943e740e17fe4582d873e3333d4f92099d0df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972394, "uuid": "8d9137ce-cee0-4e6d-ab11-939a2c886567", "comment": "Malware payload (Mirai)", "value": "217d73237f51a9ea13f54e7646c4392e64a0ff1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972394, "uuid": "bb510997-7233-4396-9480-b842db749d0e", "comment": "Malware payload (Mirai)", "value": "81e3d14e843bfb2fbb1f44405b04647b8131c637e4fa58e0364befc9dc060e64031a6480d2a8d39bf196a6b88f62568d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972394, "uuid": "720339ec-4fed-46e5-a4ae-011a5d709005", "value": "T1E9F33C06731C0947D1632EF03A3B57E093EF9A9121E8F740755FAA8E9272E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972394, "uuid": "b86393b7-a96b-4ad2-88e6-7e5cd33249d3", "value": "1536:uBQRUl8riIHoFTb0daAFwsKUfWdxxQMF43F3ZTTNF8YZwJFT0KXwgzWvAtc0z1RD:uNiipFsWDxElZXVwL0WTt5JZ88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972394, "uuid": "ff3d989f-0973-4457-822a-17c70f558bbe", "value": 162512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972394, "uuid": "0898ec3b-f584-40dd-a271-c8acc52d3dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972394, "uuid": "5ab1fa39-af1f-4d31-a1e2-c87e0b6e3358", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41761744-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928120, "uuid": "344c9267-e888-49b6-b897-3ebc5ac8478e", "comment": "Malware payload", "value": "dc938135e70b991016dd66341f95699a", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928120, "uuid": "96b8aff7-58f4-4649-9bdc-cc748b974e24", "comment": "Malware payload", "value": "6984cb0e80ebd7e771e4d0c4a379ec7113bdc4eaf387a5dd8894f447fe09cd8c", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928120, "uuid": "0434346b-c4dd-444b-b004-bb91baddd11d", "comment": "Malware payload", "value": "3e321e286af7d79145dcc37b54f4916a7e117f1d", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928120, "uuid": "97ce275f-570c-419d-8b3e-a7659acfe3b8", "comment": "Malware payload", "value": "51c6bfd4b76bede0f85e3b44875f0d9ab04fb002de79702f005e982aa83c2c3d1c756c3c31e611618bd7ae6caa6aa842", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928120, "uuid": "f4d4dc19-93e1-4284-83de-063e84ba99aa", "value": "T11327234E502F2F734AF5105D42E618BB16F9CE5D1192E6FFDA8F2C94C32FA2D19091A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928120, "uuid": "5af99b6f-b1c8-4588-b6fb-a13ce8d9c7e3", "value": "49152:i/UjK/UjJ/Ujp/UjD/Ujm/UjA/Ujl/UjG/Ujv/UjD/Ujs/UjbMvg/UjH/UjC/UjM:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928120, "uuid": "dd5d2cc2-4313-4815-bee6-e50ee06ae388", "value": 22091526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928120, "uuid": "2e697a98-12e0-414e-9d46-cbdbe8146e36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928120, "uuid": "c93b6217-4a19-4b8d-8a31-982d26c21167", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58010937-3eb3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776907542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907542, "uuid": "b5451030-0026-4359-8627-79f75ea77179", "comment": "Malware payload (QuasarRAT)", "value": "89174bb2891502cab841d97e2d29cf03", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907542, "uuid": "20bc38ba-475c-437f-865c-884a6a05331f", "comment": "Malware payload (QuasarRAT)", "value": "6a3ca2af5a54ddb0c63182cc25ac4f9a4542be30cf7d9c11173b755e467fb39e", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907542, "uuid": "0a35db24-e4c2-423a-9b1a-abf3c09ff15c", "comment": "Malware payload (QuasarRAT)", "value": "f5925d2b155b5ee1854cc17d16b10db618903658", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776907542, "uuid": "31c3775e-76b3-4591-9865-5c9113948b32", "comment": "Malware payload (QuasarRAT)", "value": "2997e081ec36582f82d85ddbab926a97fb062fd7aa49badbea26831f45fc0e41c3bc6c8d754520293774b2fadd1e30d5", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907542, "uuid": "0945a013-7bc8-43c8-865c-b04844b3ffaa", "value": "T11601970EE53CF2321561C462ABE92C2D3C90889BF824F8ED63B844284196B3216CA4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907542, "uuid": "16d6200e-b2dc-4ecf-bd50-53bdb5675ff8", "value": "12:MnmCm2Xu0LvFMGZJcMz9KpMkFUnGKoqLLdWduMhrFAnEZm3Uu2JlMG0LKR0LiIMw:MnmC3Xu0ZMGZuMhHOUGKoq3GuCsEYEul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776907542, "uuid": "40159686-9f5a-4b39-b474-7df5aa7c2d59", "value": 737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776907542, "uuid": "91dee169-1c68-4752-8294-ccde2a682e56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776907542, "uuid": "100e5ab2-4622-4c42-a06e-27915d7a32a2", "value": "bDci2sip.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1728de-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968274, "uuid": "f7e40122-6290-41c8-89aa-6d037d2e2291", "comment": "Malware payload", "value": "459f15231a02c35d0aa8a5b8d6a5f393", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968274, "uuid": "6ebf3d10-93a6-44e8-9543-f82000ea1307", "comment": "Malware payload", "value": "6a75ce2897a5ade56c4f7e5240cbefe7fc7fde599dd6f95949289a2640e3ad22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968274, "uuid": "89690463-3884-4afc-867f-94db2a330c83", "comment": "Malware payload", "value": "d473eeb85434bc33ef67ed694e6d90a35ad8507e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968274, "uuid": "950f7031-2fc4-4e65-bdb5-c111ace76273", "comment": "Malware payload", "value": "12a0fe1531bc55cf561cb2c9020c74d470c9db3140e50dddd33b00ad3fcc91d72c0666cdef6047e833094b6fb5513d90", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968274, "uuid": "77d5b26a-a624-4cf7-86e3-7b6ffd5f5b8a", "value": "T17C86095892C78A14F2FFD5B16DAF3EF858C51D3C12982936DF84315E1AF9972AAF0420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968274, "uuid": "2b8767d3-fa81-4bc3-ae87-f9f22391852e", "value": "98304:4uEiWE2xh8TtJRcHC2/hBcRT/vb9QO1XUMrfaNbsadt:JE20qFGCqhBkpp1XUMrfVadt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968274, "uuid": "73f253fc-8020-4909-a4f6-e438482aa340", "value": 8522401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968274, "uuid": "699a6e02-ed43-4549-885f-c6bf0f79e54f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968274, "uuid": "04810ede-5872-4de3-a821-cf08e4dd68cd", "value": "6a75ce2897a5ade56c4f7e5240cbefe7fc7fde599dd6f95949289a2640e3ad22.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5448561c-3ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776913119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913119, "uuid": "5e4b9cc0-0f59-4759-b0de-00db40102f69", "comment": "Malware payload (VIPKeylogger)", "value": "54a8827f55792a6e0d3817e80ac2a318", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913119, "uuid": "bd8e141e-6d60-4fec-8b3f-4e0462fc7604", "comment": "Malware payload (VIPKeylogger)", "value": "6a94e0e6917dac14fe32db0e46e328251ca2baa5551712ab5a9b6e008a0ebd6c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913119, "uuid": "c15601e6-d3ac-4a6d-a6c4-de28332fb0f4", "comment": "Malware payload (VIPKeylogger)", "value": "8b30ba6bca841026b199e955822b6459ad44d981", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913119, "uuid": "45f3bc04-ae14-49a4-af5c-e7a7ba2f722d", "comment": "Malware payload (VIPKeylogger)", "value": "f527d74fece267fa5504698da3a051e4a7e41f67fba68643886c1837dfc7be384e38ea74d11650575aaf6d59eef2072a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913119, "uuid": "95265a8f-9a0e-47a6-8494-a52b8565672b", "value": "T1CB9423E8665C7EBF7604C7FDF2F2474A3586D6D1AA0A53AA17C40C00C77AE56273B086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913119, "uuid": "0680d425-ffb8-4d51-8d0f-3544346d9615", "value": "6144:LeL6+TxqwoyrQfJ0UCLh1rmGOCxgExJtdP2xy1Z/JKv5F5sgJesDGZG:CxTxqd4Y6UCLh9mkuYPoy1ZMvJe4aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776913119, "uuid": "33430de6-f145-4b87-aefa-bd5bf84d463a", "value": 414677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776913119, "uuid": "6d44aa37-8eea-4f0c-8870-f8501811a51f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913119, "uuid": "aa1426ff-7396-4feb-9b17-e4970b17460c", "value": "pace.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d9e5c3-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944777, "uuid": "7a7eface-23f4-498f-9bc7-43e2fb0b6109", "comment": "Malware payload", "value": "b4d90d1bfa7217db36dc6b50ed1f2c0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944777, "uuid": "c14c091a-022a-419e-81ec-59a3fd0d21e9", "comment": "Malware payload", "value": "6b094fd9d3f27d3684bcc69452c96049afadb3eba3292ded7e59fe6f95e6b314", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944777, "uuid": "cf2d2bb2-2d4a-4b42-b4a1-36b98e367b5e", "comment": "Malware payload", "value": "6f77858faafc1f6f2e371ac41fb7569deee62d0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944777, "uuid": "6a6e0a63-fc2b-41fa-843a-c0978c3fde0d", "comment": "Malware payload", "value": "9ac226c2ed85e092f7c00479f338e6461d38d816236dc61fe746344536f9047d67dd181bdeb8916ce779751a97516cce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944777, "uuid": "a08e2b08-bafd-4787-9321-0c4fcf08f146", "value": "T1C771230797E8856BE0BB4730AEB3874766F4F5908F73473E08505219BC616B44AB1BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944777, "uuid": "8c0616a7-9f04-4b9c-b62f-38bc8fe58268", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944777, "uuid": "36b27eaf-d0bd-42ae-a5b4-0388002d76ce", "value": "24:etGSI9Rz1Q5Dr+UCPaIjp+GGqFtkZfc5moMgFDb2WI+ycuZhN4akS0PNnq:6Exh+7Jc5mQb91ul4a3Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944777, "uuid": "f82aa84f-5c1a-40af-a257-fd488c43ec79", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944777, "uuid": "d9647ca3-9df4-498c-93c4-18a98590af9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944777, "uuid": "e0aee40b-a5b5-4a6d-b9a8-f6ca0149d889", "value": "ftqiavmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de13f45c-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927953, "uuid": "f3097e62-48ce-4e25-9da1-24a0b3be3c87", "comment": "Malware payload", "value": "caefe4d00d61ae3b6f1f2ccf1b13fb03", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927953, "uuid": "31138331-0fb1-4acd-beb9-4537db8d0549", "comment": "Malware payload", "value": "6b6f612c9289dce52f5d0127806725c0053307d71815ad8eb5ad95384c05dbb0", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927953, "uuid": "f40fd3ed-853d-41d3-9ee0-6361976b395e", "comment": "Malware payload", "value": "b508b4c385c36427fd1c1009e6715c8728925690", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927953, "uuid": "6ba9a5f2-e60f-4340-adb1-4b95d74a4799", "comment": "Malware payload", "value": "811fff0dd8270db00db3f5b63ab7d0816e6fac43f963e23ea1c45e8120f1ccf4f9124f140de537c9a1cb9ff0d427e240", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927953, "uuid": "ceb4d843-5991-4818-84a8-bc38ad277981", "value": "T1923723218F678FAE47F17244C1AF6E4F0A845E34E5082DB397F73960A6893C993E3255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927953, "uuid": "47d9e8e7-776e-4417-8399-85e1cae7dd4e", "value": "49152:GFCFxFHFXFoFKFYFOFRF2FAFiTQFnFmFIFrF1TtF2F6FxFVFcFNFLFrFiFyFyF2A:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927953, "uuid": "59e8095c-f429-49b8-b3ee-8d4398d13f59", "value": 22571572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927953, "uuid": "2878a302-57cc-4cb7-8e41-e7bb694019a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927953, "uuid": "fc2dea58-30d6-4ccb-a447-653e22584a58", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a060e3a-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976130, "uuid": "e075a637-6e1a-4e5e-9aae-80f64094e80e", "comment": "Malware payload (Mirai)", "value": "87be56e193f45623a1039886692589a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976130, "uuid": "68db10db-9059-491a-b3b5-04eb775f25c6", "comment": "Malware payload (Mirai)", "value": "6ba941e4627f30f6b628c1ccd0cb72858ad58e8957d15fb4388046d93a2567b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976130, "uuid": "58c5e1ad-217b-4629-9743-ee69a5848ea7", "comment": "Malware payload (Mirai)", "value": "5f554e87142aca38b65521224e86b945fe9d7eef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976130, "uuid": "7f65a01b-aaf4-4f2a-8ad6-8e0e3a71b1d2", "comment": "Malware payload (Mirai)", "value": "8fe2c29f391aa58bb2dcbed430e6ccdffa51827011308ab05ad7932ae32eae172ca776d0b3b07feac09416ef25d637e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976130, "uuid": "ecf81c06-f140-4c2e-a102-eaee5ae21a3f", "value": "T17CC35A63C8266F58D665D0B4F0748FB92F53998491830FBA29ABC2784483DCDF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976130, "uuid": "cbf252a0-4a95-476c-ae25-0a6c98c9b005", "value": "1536:FGRSxHsMkoG+EFwMH9FxrN5Cp7Kew6j+K01mGEQWyVKDvFnbp:FsMBWwM1Z5s+eV01uQWoKjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976130, "uuid": "569d25c1-010b-431f-9e32-2c1414e50f26", "value": 125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976130, "uuid": "70e32ccc-a8af-48df-b33e-c25fef950c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976130, "uuid": "64ba625e-dca9-4323-818c-f68cf18446f9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4204e444-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776972359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972359, "uuid": "8fad453e-f016-47e7-8288-1d9f90e44e85", "comment": "Malware payload", "value": "9960d2d5edce3c52fe5c0fb8b5300e45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972359, "uuid": "98fdfb7f-9f98-4b8e-b9c6-9661ef42f821", "comment": "Malware payload", "value": "6c07b14bea06fa102aaa8d584014124751fd934deec25f3f63943f560c5e060b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972359, "uuid": "c534ccd1-e30b-4ebe-b8d3-0f694f7ae5a9", "comment": "Malware payload", "value": "3efd2434f98a328db3dfcd6c5aafec971e0ccc39", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972359, "uuid": "c2c1ff01-0ae2-4ec7-9871-5f13f055d446", "comment": "Malware payload", "value": "04a5d4bec5ac1d1623fff5044c379f8b4a6c1d1b0df29e60764516e25b321cea1b9d5c81ca0593784193a88d90d60165", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972359, "uuid": "e0193142-d0bf-45fc-a234-f20849a3f148", "value": "T19161CDD662140B37DF4ACC16BE648C4D31D852C428E6BF08DCFBB1A3D58EE48B002E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972359, "uuid": "89c245f6-0e88-435b-a43e-b7489cc53781", "value": "24:5jv6r/7wU6r66rYf8r6rj6rclZ6r+xNILXkU6re6rPxGy6rfU6rz06rh356roLq3:6/7gHYf30clGlXsTPxGPNJAX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972359, "uuid": "afdefea1-215f-447c-a3b0-041c0650a5b6", "value": 3332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972359, "uuid": "139fca1d-e871-4a35-aa21-e8178b4aeb85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972359, "uuid": "1d256574-e863-4896-aec7-4552f58aa471", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb6f281-3ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776913110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913110, "uuid": "69064835-9e36-4842-b8b2-d35276397fc7", "comment": "Malware payload (PhantomStealer)", "value": "61a5049fb91d6a8b1659c267dd2d8713", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913110, "uuid": "90db17fd-dcaf-4ccc-ab38-2df0c49da917", "comment": "Malware payload (PhantomStealer)", "value": "6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913110, "uuid": "ec125f36-cdc9-444d-a867-3dbb2ed4fbce", "comment": "Malware payload (PhantomStealer)", "value": "17d136a21801102060dabe962c0c7f472ab5d194", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913110, "uuid": "f9699e3c-19b8-4dff-823e-4fa299b646aa", "comment": "Malware payload (PhantomStealer)", "value": "ff7d67b92231c2b2e058c172e810debfa1925005d5fb71fab356fd8a2f99e91f26db1b71f8b059d1a4488b0d3d093bf6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913110, "uuid": "a1696c1f-2aff-41f5-9e0b-1410a9ca7302", "value": "T12835F215D6C87F78CFA85A3980FD1A1E73E09A4B9016B94AE7237C4AAFEF544020F1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913110, "uuid": "5cc05ce3-06a5-4951-a94c-b4b6b1819aa4", "value": "24576:O1c/O+dKc0lIhuMbA1JvGZGhan0GSSFfx/B51Bo:O2xQcAI0bLaJlvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776913110, "uuid": "5266ceff-a9f5-4517-a145-69b649b0f2cb", "value": 1134008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776913110, "uuid": "43557c68-59c7-4c76-80f4-a0641f7fbce8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913110, "uuid": "785fdac7-f96a-4afe-a0c7-d4f7838ca7a1", "value": "Indeed.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adcc762-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776954013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954013, "uuid": "2f768af8-5f0a-4475-ba17-f59cbb378343", "comment": "Malware payload (VIPKeylogger)", "value": "d9a3246eb8c63cced39a7e2f0bec3ae4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954013, "uuid": "c8945be4-87b6-41ad-b2d9-10cb69e092e2", "comment": "Malware payload (VIPKeylogger)", "value": "6d2e5ab52d3ad9b96526c3ca342c68490ee86e515bed8c9d865ed89735a8802c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954013, "uuid": "6c1c85eb-de3a-4f56-b263-97842216d334", "comment": "Malware payload (VIPKeylogger)", "value": "21fcd82535bcb4b948adde02b14ed62cebe30f7a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954013, "uuid": "3e1d919b-d189-4f47-9b7d-ffc4e7adca43", "comment": "Malware payload (VIPKeylogger)", "value": "cacdd2a114b42da0f3754474f9d442a5ba7bfa5d69653829f96810b8ebf05f10cad0efbe2e68c38b1a8caa2c573fbca7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954013, "uuid": "38f1e443-d68d-4154-93ee-a6246487a896", "value": "T141C590921432637F1A06261225402E3E17B8795FE5D13E3FB88897DCB7983772E76722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954013, "uuid": "cbf24a02-581a-4a72-8773-deb99af22d3a", "value": "1536:a43434343434343434343434343434343434343434343434343434343434343A:M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954013, "uuid": "5c0ff596-9d3d-49f2-9c67-7cca00cf4ddb", "value": 2731296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954013, "uuid": "caf63ea3-b20e-45c9-b054-f216b5ea25da", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954013, "uuid": "4a6b08b1-4eff-497b-9a80-dc003f0fca80", "value": "Faktura 01878-260422_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9654a13a-3f45-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1776970353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970353, "uuid": "16509f90-4c67-45bc-9c6d-8e2a7a9b1d25", "comment": "Malware payload (VioletWorm)", "value": "902f1aa7ef1db68c10725301320d552b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970353, "uuid": "434625c0-84bd-4deb-944a-d30091310a94", "comment": "Malware payload (VioletWorm)", "value": "6dd0cfff4f83346cf6a1a3282507f1738ee5499773a962e97c7e3bd29e54a6b8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970353, "uuid": "13f7ab23-ccd2-4bb7-b29b-93af873300d2", "comment": "Malware payload (VioletWorm)", "value": "0dd758b86748931c99552f482f1b72f6c1d2933d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970353, "uuid": "c6807329-d903-468b-9007-58f57fff6509", "comment": "Malware payload (VioletWorm)", "value": "6d3381e55fdbff66c61319388a47b539245eab513a60c3236be8b3725adc8e41cc41163f1608960278243532f6a7c978", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970353, "uuid": "4238ef2f-6642-4afe-a329-b535ca8f00f3", "value": "T1EAE39D69A3A224FDC15A917556D797B3F8B3B8311320AEBF0364CF352FA5D40772A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970353, "uuid": "48f83405-7b9a-4cdc-9a22-e7c31625998c", "value": "33864723cb131980323258c0b4d79fb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970353, "uuid": "45ebc416-827c-437a-92d0-af88f601ecab", "value": "3072:fRs6zb6g6VVTrHLRWbaeISh8h65HLQDzRQYzuJE0scP7:pbb/6VVTrrRAac8g5IzqYzuJgcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776970353, "uuid": "3150d5b4-bdc9-492e-b769-6e995d30d0a1", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776970353, "uuid": "7c6e1cfc-0c7e-40c0-ac35-9993a2590ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970353, "uuid": "228243d9-33f5-4e31-b115-5815b521bb00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335c9de7-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776929385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929385, "uuid": "ad5d07aa-eb2b-4680-a591-ad803afca61e", "comment": "Malware payload (AgentTesla)", "value": "91d6fddb0778fd00fbbe0d2498a72d1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929385, "uuid": "671585ad-dd9c-4299-b602-7377250ca71f", "comment": "Malware payload (AgentTesla)", "value": "6ddc79fe52582ee4e822670d4673b56c753917ad8df4e67ab5172c68f580e97d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929385, "uuid": "7833b284-a8b9-48fa-a1d2-8fac501657b9", "comment": "Malware payload (AgentTesla)", "value": "73cdbffcb2beaad9a3baacbdd075cc2ff984a510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929385, "uuid": "51ecf7b1-09d1-46d1-859d-a02ac7b44325", "comment": "Malware payload (AgentTesla)", "value": "1359793ab0dbd24ae20f46bbeda976e3ece45818030a5b61acecae149c6a0284faf05d6803caa8504b945e532d1cf805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929385, "uuid": "cdc86289-5075-4aaf-b0d1-11a01f04138d", "value": "T1476502258DC46FB5DFAC5A1C80FE1A0F63E04B8A5016B589EB33BD467FE7904121B2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929385, "uuid": "1b590192-5cb8-43e6-b1cb-cae0c710e4f5", "value": "24576:c5zyeJnViLFEHTSaBH4IKayLh4J7JvsoTCt8:cNGLgBCQFJG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929385, "uuid": "bc9a8610-f676-4ef2-aa93-b15db2771fd8", "value": 1415997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929385, "uuid": "4c68b7e0-5ec7-4dcc-b2cd-74e6120761e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929385, "uuid": "554c7303-d378-49f5-9a89-f4204ed5f85d", "value": "Agency_Appointment_Letter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d259d283-3f11-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1776948120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948120, "uuid": "afb28d3a-1a41-4b6c-8072-3d47bce5bcdc", "comment": "Malware payload (XFilesStealer)", "value": "9aa5ac1283fefa16e02200b2f30bc77c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948120, "uuid": "69b1ea8e-4922-4e2f-8f89-ac980a9a2d1b", "comment": "Malware payload (XFilesStealer)", "value": "6e7375bde1198e0a95e7f3d9a3a9a60ab6ddf08535d7dea38d55abd234f66e0d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948120, "uuid": "2a1bd17f-dd6e-4d7a-a286-6a7f318d1676", "comment": "Malware payload (XFilesStealer)", "value": "557b00db067d6daaeed15e91a6509610b7b286f4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948120, "uuid": "dec5a299-1a96-437c-8557-1093ffd9c834", "comment": "Malware payload (XFilesStealer)", "value": "15c5785685212cd31e6f0d5f6ef0e43dcb703acca7a009b09e67c27741e8a56d3a7acb9805ca7f517cd040e9678cd230", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948120, "uuid": "0482e3f7-3991-4692-9bd4-b19a79de42c1", "value": "T13917339BCE427F76F263DA3F47E1172D55A12D535453C09BA3223A3C0A36B816BF9089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948120, "uuid": "333f4e81-f131-4ca7-b15f-f8e5de79605b", "value": "393216:TyMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pG/W:WCj8XUW27YWFlbaAHbhLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776948120, "uuid": "0ed7908d-cb2a-474a-affa-cfd003f067c5", "value": 18878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776948120, "uuid": "6d563dfc-a263-42c1-9f2d-cbf280fcadb6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948120, "uuid": "dc112265-859f-40b5-8089-6aa979768403", "value": "Auto-Gestor.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6779ec4b-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963402, "uuid": "79bcb952-9859-48e3-8d49-3e9dcfbed516", "comment": "Malware payload (Mirai)", "value": "5a4f49fec7c52719369c9465f61340ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963402, "uuid": "6dee4f05-a1a5-49bc-a4c2-374a860a7f87", "comment": "Malware payload (Mirai)", "value": "6f2720000cc39c766bbe14b34221a38f9b3b143bd1252884059f781eaf1d6965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963402, "uuid": "b67f8341-f4bf-4e4d-b42d-08bd9a40287d", "comment": "Malware payload (Mirai)", "value": "e961d5af849bc3b55edc168fe9100da40171ed78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963402, "uuid": "0e83570e-be5a-49f0-84d8-d8821492a4ad", "comment": "Malware payload (Mirai)", "value": "192a695ff742e8e4500d0a94252fd8125a6dcfe6e5652aa725b42311b1fefe775f4fdede6d57a13d32790891dc66cca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963402, "uuid": "37f023ef-476d-4bac-9ffb-662a708216fb", "value": "T10EE32B46EA808B13C4D6177ABADF424633239B5493EB730699287FF43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963402, "uuid": "f61d85d8-5ecd-457b-9bdf-16cbcc74f253", "value": "3072:LfIWnM9uTk1zXxqaNbIkz/rnN/9Yx5TQBuPPDM/9+10g38VnE:LgWnM9uizAaNbIkz/5/w0BuPLM/9+10i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963402, "uuid": "e1ad5ae3-cdb9-4139-bf2b-1ba245a75538", "value": 145461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963402, "uuid": "ce35d9cf-3b42-49c7-b21b-1c09c07d408b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963402, "uuid": "de620caf-f335-4d4f-bd02-e842eddbe886", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97b1f16-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776946011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946011, "uuid": "26b562de-6484-42f9-9f0f-cbb02b9cd043", "comment": "Malware payload (AgentTesla)", "value": "d3a7a70547af9e90f948bc7d2766538e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946011, "uuid": "bed67759-9264-4115-bcb8-ab31215ce4c6", "comment": "Malware payload (AgentTesla)", "value": "6f8ba0c5c6733bf25b8008082a3a16635b1587479549a901bc30b3f8a19f079d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946011, "uuid": "eeb92dd0-c28d-4e1e-b6ca-6eb04856ea48", "comment": "Malware payload (AgentTesla)", "value": "223d57a23ef98c42879d32ae927ad9320f91a794", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946011, "uuid": "4f5fd43d-fc88-42c8-bad7-64f079fff49a", "comment": "Malware payload (AgentTesla)", "value": "05dd7edf33b28a96383b40b05245a927af0b9f9ac105606bfaa90bb00fdd909dde0d82b5e7140b54d4446e7d30f60b5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946011, "uuid": "0c3e2294-fdd6-44fe-bd44-a82a41ac8b5b", "value": "T14925BF219A976F58E53E4B3C8172054CE3F0C9036397DB1BAEE812F61E52F88D9274D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946011, "uuid": "df455495-3c79-4dc2-be55-542cb240c3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946011, "uuid": "fb5e3278-7069-42d7-a958-ad3c0a74b713", "value": "12288:XJZ799lnNQ6+4r4s5XO+MriwQUaYeP4SQGoBFifPcCFoGworua9NoJ:39m+ZHMm38ePPsGPcCFoGwoa+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776946011, "uuid": "ba19ef0a-b764-40aa-ada4-281f739a8c9e", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776946011, "uuid": "77c0d83f-fcc9-4120-b316-60eabc2fd20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946011, "uuid": "c716be62-ee59-494c-9eba-09f7f026d4c7", "value": "Detalle de pago de notificacion de BBVA MXN 10703.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63125cce-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1776930753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930753, "uuid": "790949a8-ba1c-42a9-9485-4d209be801ac", "comment": "Malware payload (QuirkyLoader)", "value": "2e30f3c00028797cb1f005e41eebaa63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930753, "uuid": "4b8a207d-bb2b-4822-a81f-de2fa2fff905", "comment": "Malware payload (QuirkyLoader)", "value": "7009224bf354be57ccf654314df4fa8a7a93c5cd0ad75995e0d602d382c7defa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930753, "uuid": "d49cfcd0-dd2f-4283-b1e8-d5981369110b", "comment": "Malware payload (QuirkyLoader)", "value": "19fe39c1e09265515645592d96c865d98146a0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930753, "uuid": "816cbe05-be6e-4b52-b49f-9ffc886e9389", "comment": "Malware payload (QuirkyLoader)", "value": "85742f1e042b2bcc21789f6fb3f1dc46bcc8a97a08be6c02d0846af3a4490c1c87876ed1a1d8766998a60f9eac786ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930753, "uuid": "6763666e-f3e3-4b2e-914d-6db496955a20", "value": "T1E1359E19E3D866ACD127C974CB52A232E2B174560762B9CF0B99D2152F73EE06B3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930753, "uuid": "e4ea0cba-dd13-431c-94dc-e771eb0d3d72", "value": "2a4e1e629485f85ce39f2672c970eb1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930753, "uuid": "7f11d257-3304-4fc7-93a6-5a0d30761063", "value": "24576:06fhOTYYUK4S0WbCdlpab63bJ8Sm5e3FhJHrulGIs:06fhOTv2lYb6l8De3FnHClGIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930753, "uuid": "25c2e3bf-3a25-4044-96a4-4d90047f078d", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930753, "uuid": "d445561f-32cd-4d2f-be9f-64251b53655a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930753, "uuid": "b934f7b5-5905-497f-8c21-bd6fcac826d5", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb907e1c-3ed4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776921882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921882, "uuid": "38180aec-1998-4d8d-b54b-93bbfa44aa65", "comment": "Malware payload (Mirai)", "value": "374f07bd0cdb8ea0f9dea3820b314158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921882, "uuid": "48949ba2-271f-4009-93c6-465d6378836e", "comment": "Malware payload (Mirai)", "value": "706c36b15be5740e9e5b1cb739e238cd845be92ce6a0742a1248473aaa5144ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921882, "uuid": "3638aef5-16a7-4c6f-a57a-a4d2a0329682", "comment": "Malware payload (Mirai)", "value": "9335defe58645a6ccfb4d5ae88ba708aa6d206a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921882, "uuid": "df06065b-84a3-4b06-ba8f-f896950fba95", "comment": "Malware payload (Mirai)", "value": "5b8b54048fe8b13aecf47c5feb0c37f28092c1709a600fe2f0e28c45946b0ff662b67613f882ef6c2cf527a0697af227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921882, "uuid": "7e31cc01-fdec-4f51-b98c-eee065f788f0", "value": "T110C2E1E07726FA31C4206C3DE52A4D8A3A510A7C90FF353764258C399EC1A5B63F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921882, "uuid": "1ea6953d-095e-4e9f-9eca-3986fc37f351", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrw9q3UELun:PKy4qfqoeJdXWg5LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776921882, "uuid": "0054c155-256d-4b92-9e09-2a5e56acf877", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776921882, "uuid": "ed2c3d5d-08c8-4ae7-9647-16381983c24f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921882, "uuid": "72dce185-a2fd-4447-bf7f-11bff4933b2f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0233d519-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976117, "uuid": "d83e754d-8efb-4bca-af5b-9cc647f47e3e", "comment": "Malware payload (Mirai)", "value": "8eade85db22ca05d8413eabb600b5470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976117, "uuid": "01263d62-c2c9-4169-a7da-dd96cd57eafa", "comment": "Malware payload (Mirai)", "value": "707ce9e3be90c52c638438608d7f94e213c2919b136437e23fc3e91fe8aa6421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976117, "uuid": "e5a88def-d9a5-4fb3-88f3-6b1a05373fa8", "comment": "Malware payload (Mirai)", "value": "d279da4f272af2afb5c81baa7efb5003adf53355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976117, "uuid": "dcd50e37-4b6f-4894-aff3-9f09850c8381", "comment": "Malware payload (Mirai)", "value": "e8f49080ece266c9a2951edabdda24b9c80b74a64c2e6f69bf3c9604a4bf2179ff0e226d326ef1cc137aa877b6c711bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976117, "uuid": "a71b56b8-bb43-4e87-a70c-73e894c3d121", "value": "T177E34A0A75D094FDC8DAC2B88BAAF537D932F05D1138B16F27D4AA272F4DE205B2D641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976117, "uuid": "a54bb2ce-a5a6-447e-a351-219c7f991297", "value": "3072:hM4vHgLtm9NCOqLlUVPuv+5AHDmA75HF:hM4ve/uASCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976117, "uuid": "327cd06b-7e3f-4bd5-85ab-65cf30e4105b", "value": 143800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976117, "uuid": "e07fc36c-abfd-4fbc-8b54-a53b66584382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976117, "uuid": "4b26dd82-d37f-4749-9da2-b3f9476b4636", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dfd741-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976170, "uuid": "ab43282b-d7a5-4aa1-a628-00f165d082da", "comment": "Malware payload (Mirai)", "value": "3c91f07e3a4374f28c7c43029ed4ad63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976170, "uuid": "3d3234ec-071f-4800-b87c-11e163a9257a", "comment": "Malware payload (Mirai)", "value": "7096d658df54c6feb0cbb6614f05558b9daca67040c18db46823f34a4c6c52e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976170, "uuid": "b38e2bd3-2de7-4dc4-8c91-8d9769de39f1", "comment": "Malware payload (Mirai)", "value": "e5aac755fcc66f3f31c2dc3712fe8ff5d002cdc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976170, "uuid": "f8962d98-bd62-4db0-b721-c5c836e9e32c", "comment": "Malware payload (Mirai)", "value": "c6a016411c9e0789aec735479fc82233a92f7a4a451a5b04cc33fbf69d53f5dde4f2182d3f7608b686c878693bed8b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976170, "uuid": "102c11fb-ef4e-4b05-99ed-07c93685d6b5", "value": "T1F0E31B46FC419B12D5D111BAFE0E128E37131BB8E2DE72029D246F757B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976170, "uuid": "52662a09-f04b-4771-8c2f-16e0b7d48bc6", "value": "3072:Pux7NEQtU5omkUXHNFzF1aTcIqn9C5YLnPetUg:rQtSkUXtFzLaYIqnw4PetUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976170, "uuid": "d1195508-3e7b-44f3-824e-27bdff07416f", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976170, "uuid": "32348569-de04-4603-a717-4ae4d25b38c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976170, "uuid": "295c1a5a-3798-4338-b408-90b97478dae7", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ab1560-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985550, "uuid": "26b4e373-90d6-47e0-ac3b-263983cf8e1a", "comment": "Malware payload", "value": "d1e0629cb068f76e0b226ec74aac59f7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985550, "uuid": "bf77edd9-9d00-4de9-8023-35a6d2b1b1cc", "comment": "Malware payload", "value": "70d294f2d6fda6475dc6c333c7e7b630ea51575d057ea55c0886beb518beebcc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985550, "uuid": "7506b1bd-1a3f-4d9b-918e-7034ab663bfb", "comment": "Malware payload", "value": "f384b2d386e6fd3ed1d0264c656b84fa28b48f17", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985550, "uuid": "7567fe01-6520-4ad1-bb11-bc841abf92ef", "comment": "Malware payload", "value": "82bf5fc420da251d84b701493b694bdb0a04fe48cf034d948c17c3696b41ad22215a73aa91364a783b2414bbd3ded263", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985550, "uuid": "66228b46-a155-4019-bd7d-199468b1bb9c", "value": "T1E21523152DB53EFA276151E970BF368D5B868E7098BCC79692DC0CC6720D682072FC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985550, "uuid": "505cbcb1-be9f-4cb9-a9df-9577921b225c", "value": "24576:lW6+BWiUWfymeystS173rNqc6pek2h9OK9pASG:l1ckW73P39hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985550, "uuid": "f3446d56-8cba-41d9-8a80-a57e18adf90c", "value": 894259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985550, "uuid": "69a9676f-9d7b-47f5-bd3b-bdf90cb868f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985550, "uuid": "84576772-01cb-4a3f-8ab5-2e7e65f21117", "value": "Campus.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34ad233-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944309, "uuid": "397e9042-6400-424d-8bba-51f722c6efa9", "comment": "Malware payload", "value": "f6c0304671c4485c04d4a1c7c8c8ed94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944309, "uuid": "341cb9f6-0d29-4123-92c1-47e73f900f1a", "comment": "Malware payload", "value": "710e8c96875d6a3c1b4f08f4b2094c800658551065b20ef3fd450b210dcc7b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944309, "uuid": "0688a135-1b7a-43dd-82a7-804392c91b88", "comment": "Malware payload", "value": "57966d0a5d47f580a77957b479c5e36c8a2e8a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944309, "uuid": "5ddb9405-0dc6-4c14-a166-c816c3c2f55f", "comment": "Malware payload", "value": "a9e8ad21c40967448970e69583f79e7c14e1b76b3ea0ab7facf466fba0f663838daa43d5a87d0fc692e234f0e134fa96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944309, "uuid": "46337ce2-5ed2-4d16-9a9c-3c9e6ded3192", "value": "T137559E6566E500E8D5B7D074C68666A7FAF1B42013747EEF0DA89A222F33EE0133E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944309, "uuid": "d6b24e20-c282-4c69-83b7-11b649850f2f", "value": "f4b3fde8d45d3569d6514408e8b02df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944309, "uuid": "674909e1-80d2-4500-8a44-00bda092c601", "value": "24576:8FbpQCgnGN1o4w+fkWq8tRluDV7e1WFu+dVVv9m6octogu9RyH:8LQCgnGN1PfkkgVi1OuCQ6octm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944309, "uuid": "e8def309-a282-44ca-9ed4-a260379086ef", "value": 1343920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944309, "uuid": "1eee8136-ccef-4e40-a046-d3fda1693332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944309, "uuid": "c8e163d0-b2c8-4b3d-8f32-4237bb8c4461", "value": "710e8c96875d6a3c1b4f08f4b2094c800658551065b20ef3fd450b210dcc7b9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bcade1-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934888, "uuid": "91200cd3-57f1-403a-8e06-b76d91d412af", "comment": "Malware payload", "value": "26a7e60ebc4e7c2a8b2a97dd688dffdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934888, "uuid": "470b9225-caa4-4293-b5b4-e111ffd187a6", "comment": "Malware payload", "value": "71564510b6e7d51fc961d3428ee2cbe9d47650c0ff72b3778a679c6a73337058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934888, "uuid": "f68bd2d5-03ab-4e01-bb35-d6cab0a82f7e", "comment": "Malware payload", "value": "1ab12ac7233847bc533cc5effe66ea5003890891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934888, "uuid": "5a4f1d1d-089c-47ec-a53a-509e980f9872", "comment": "Malware payload", "value": "faee6aa3d7a7db3a694627a087369a3062798bd5cecf7df1d9a2249e27388a97fed657c953abbb7f2c8a022ad6bd7ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934888, "uuid": "c11e958a-2ad2-4bb3-9346-952a776bc463", "value": "T1A5D5E857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934888, "uuid": "1cbaa82a-cfdf-449c-83cf-baf8f14c9ec1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMB:cqYUQuVDt0TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934888, "uuid": "335ee309-c6d4-4f86-b605-bf52e5a3a9f7", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934888, "uuid": "da2923a9-cbc5-468e-9423-0d4baca1d88f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934888, "uuid": "ce45bb82-f946-4649-8fb3-5585d4bef260", "value": "71564510b6e7d51fc961d3428ee2cbe9d47650c0ff72b3778a679c6a73337058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d4d8b-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776931492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931492, "uuid": "92a26efd-458b-4a7f-a1aa-f4be307a68cf", "comment": "Malware payload (AgentTesla)", "value": "e070d4b91f27e90f072862c3005efdf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931492, "uuid": "17a3ce8e-6daf-4d07-a00b-6d3acacd61bd", "comment": "Malware payload (AgentTesla)", "value": "71a72cd8b8a3b99b45dacf8e0275f97fbb8599c0ecd594554499ee1a32962519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931492, "uuid": "024ac6d7-308f-4ab6-8dde-463a38cca6ba", "comment": "Malware payload (AgentTesla)", "value": "e7326d76bfa825abdf819c4b87183183c8632f45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931492, "uuid": "13172577-3b8b-47da-83f9-b377f9e26fdb", "comment": "Malware payload (AgentTesla)", "value": "83c8e8aa2389f8690895e54081641f6a1d31a3f78a26cb66505281b2f343bf5a153f02d2b9858ad7d9b67ffb509c9985", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931492, "uuid": "e6e907ff-a078-4cd9-ac1b-217e70b490e6", "value": "T1F565021289C46FA4DFAC5719C0FE161E93F04A8B506AB989FB73FD46BFE76005207198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931492, "uuid": "ef32227e-9b18-474d-8f7a-cc09f775c9d6", "value": "24576:2ASr99v+6SKAQOjSmfANI9HbewM5yIkTw:6rrvmjjSqvHSw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931492, "uuid": "535029c1-58fc-4745-8117-50615335baf9", "value": 1428837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931492, "uuid": "fdf40c66-258f-4401-9fb4-270ff4f6be59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931492, "uuid": "4c21c412-4413-4413-8829-1d1392d06b56", "value": "Vessel_Main_Specification_Info(3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68a9e8d-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927994, "uuid": "e5b12f3a-c3d7-4cd0-bd86-03e39b5d413e", "comment": "Malware payload", "value": "e61b663c0f8da2f0bae9edb6f2ad3d98", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927994, "uuid": "067d91aa-887d-465c-9f04-4fe8d004fec5", "comment": "Malware payload", "value": "71ccb9032a8b6359f43b904e2a6cabb756a5117e89450c43131a8e9b9d5681cc", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927994, "uuid": "ced2b320-c2da-4a51-af6b-a0085dbad0ff", "comment": "Malware payload", "value": "86949f60ea76c90b59e6097d6a70beba5685ddfa", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927994, "uuid": "c56ade2a-1b24-48b4-9c95-eddbcc883e6c", "comment": "Malware payload", "value": "2285a082dff20836217a40ea0eed52e0ca9d9013b162ca00353cb5840604f4aba0ac44c28111008f7232337d9ce6cb03", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927994, "uuid": "a30af964-317e-4f6f-a70f-4a9f9c0b4d67", "value": "T1A22723C5AD3E9F7D6CF8226F257F0A6303BE1B002831898E9AF32C05759D71585AE61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927994, "uuid": "742a709c-1dd0-4df1-821e-9c1d3aaaacbb", "value": "49152:7c7cpcEclcJcLcEc/cuc2chcAzC9eNlccWcrczcScazC9eNl3cjcAcQc2cAcEcJg:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927994, "uuid": "e041e829-ebee-46a7-8dbb-d51a8e255591", "value": 21131486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927994, "uuid": "bd1674f3-a5a5-4f2b-b2a0-e82b4e91f77e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927994, "uuid": "9f0b4e60-d175-4f95-9ec5-4000ca4a1fb5", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc8817b-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1776956430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956430, "uuid": "7743165a-3ed6-41a7-bfe1-12de79bef78b", "comment": "Malware payload (Worm.Ramnit)", "value": "412e29ae2812d8e61672498141610d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956430, "uuid": "ef393a90-2c2f-49b1-9cf5-3f2309607768", "comment": "Malware payload (Worm.Ramnit)", "value": "7231b1c66c7000c17893420ba0a3eb8544916c3174f6796b74938ea3ad8a0c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956430, "uuid": "c46826cc-9a64-4dc1-9f4c-97de7a287949", "comment": "Malware payload (Worm.Ramnit)", "value": "601b93c5dd185856021253b9cca0526fd7f5bbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956430, "uuid": "d53622a2-f901-4645-9f25-556e5ba72692", "comment": "Malware payload (Worm.Ramnit)", "value": "e64fb4e883061ba7448c683bc50496c090ada0950a29fbe64a769d540238927cf4c439ba9e688f0fd30475db08ae01eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956430, "uuid": "425fb47d-af81-49a7-a863-fd1714ebb9d7", "value": "T12DF36C11F441C0B7C5D11AFFD5E6F2A597BC67A44230998FAB481FAB3B252829F068C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956430, "uuid": "97fee821-1b87-4de5-9e47-e1208785931c", "value": "3072:ljnAZMbIWiyr7pjvTooBFEbWwIUclTBft3+oTa:9AZCIWiyr7JHn17lTBl3+o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956430, "uuid": "fc6e6ccb-920c-468e-943b-6f7d0e177308", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956430, "uuid": "b5b464a7-78ba-436e-8923-ca939d470e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956430, "uuid": "e587ede8-9376-42c7-91e7-0c8f730f6847", "value": "7231b1c66c7000c17893420ba0a3eb8544916c3174f6796b74938ea3ad8a0c8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ed4218-3f6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776986223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986223, "uuid": "f5b50e16-ce68-4284-beec-c730b2d6211d", "comment": "Malware payload (Mirai)", "value": "c6af873d527b576b4caeeaec9b6fca85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986223, "uuid": "c17484d7-29a5-42d0-895b-d7dbe944eb67", "comment": "Malware payload (Mirai)", "value": "7251bf666432963680e47b895d02602e8b9b1b6f877ed01451865ee1a71301d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986223, "uuid": "a83c391e-c2c2-44fa-a11b-e2ca1ab00baa", "comment": "Malware payload (Mirai)", "value": "fd2ab32d7b60e3f0ffa834c6542b436313579178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986223, "uuid": "fd7c65ac-0062-4b08-a41e-bab23599bffd", "comment": "Malware payload (Mirai)", "value": "6e07b84e2f6481a36fba9b4d121c870d65f4e85069d3611a23c5f92386109af6a16b56556683442ea134d78113890de6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986223, "uuid": "a5e48835-f9da-4ad7-b64d-0e02152db227", "value": "T15A733A2365A2C67FC047E2F05BEB9562A822BDBD0A31714A33D4FE916F79CC12E19711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986223, "uuid": "f130cb7c-ed9a-4d50-8b4f-cfd4f1dff221", "value": "1536:9kNGnA5T+imk8H6U70wyFnAquuU9Oc5akLg3vMiMX07BI5KKf3SQRu:9OGA5Jijrg1LUkc5bkUi807OZ7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776986223, "uuid": "ba6d8d38-d593-4282-8fa5-94b6b5945bcb", "value": 80512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776986223, "uuid": "e186c38b-0c63-4ff1-8440-7d0563d5fb0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986223, "uuid": "f529ce88-2f8e-4b0e-9ba9-ec88e103fc2f", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9deb6f7-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944267, "uuid": "77ea5103-4752-4dc4-ad03-69004934f038", "comment": "Malware payload", "value": "39937e199b2377d1f212510f1f2f7653", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944267, "uuid": "aae15d47-c6d3-4ccc-a149-58b05643294b", "comment": "Malware payload", "value": "7269b4bc6b3036e5a2f8c2a7908a439202cee9c8b9e50b67c786c39f2500df8f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944267, "uuid": "d72657e0-0a02-4b0b-9651-98c626f49060", "comment": "Malware payload", "value": "7550727a121933a408b4b94f4f694a5f2dca02ce", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944267, "uuid": "a784874d-209c-4d37-8b14-c1bb922f04ce", "comment": "Malware payload", "value": "0cfec7e88abce8e1132eb7b0757a31a99dfc57ccec146dc9cfca8f03e2b65fe513db2585262753b0d6be96f0034ae784", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944267, "uuid": "cea49cc8-2b42-42f6-8e4c-f7d588f50d65", "value": "T1F3414139AF2CAF3CAF6472F4F8E71DA9635C0D08153C7898CA50858B51EA5988B7ED11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944267, "uuid": "f08a916c-f729-4121-8e74-8adfbea1fa19", "value": "48:3IN2IgyxITncrqJboiFg3HJxC2HJ114VwWpuUVMpv0+rPviX:iOSiC3HJxRHJ11S13yiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944267, "uuid": "e60cfb0b-d237-4f7e-b96f-e7ea57d91094", "value": 2366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944267, "uuid": "0cb59539-530b-45af-9866-063162390cf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944267, "uuid": "9db7b489-16ed-4d13-b39c-c8062f30ffd3", "value": "7269b4bc6b3036e5a2f8c2a7908a439202cee9c8b9e50b67c786c39f2500df8f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8bdb50-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987600, "uuid": "2fcb4a9a-b147-4cf0-9486-0648933dc647", "comment": "Malware payload", "value": "da4868ea2a7b7202d8844f39d8d56b77", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987600, "uuid": "bdf690b7-9a84-4318-b2ee-6e21e25b2ac7", "comment": "Malware payload", "value": "727f390662f6cf0cfc725e484171050c11f59bc4fd9bfe1ed5c851767ba6d0bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987600, "uuid": "a49f4820-2ac9-4355-a304-3ebf3d9edbe0", "comment": "Malware payload", "value": "dcaac3f60c716bfe448964acc0c711489b7062d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987600, "uuid": "929835f7-58d6-49fd-ab62-b9113c9fa595", "comment": "Malware payload", "value": "875f07ee70a6375a475701c3049d2731b3b9b809ff51e4fd54c5ae2aa93e1c04933e6c4e829f6c17d208c449cdb449fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987600, "uuid": "9d04b81b-62c0-45fc-9e71-2921c7298245", "value": "T1F8136D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987600, "uuid": "f9c4dd31-3a35-4df3-926f-d4fae14f1852", "value": "768:boXRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b8lxScy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987600, "uuid": "961f66c3-8ad6-4008-bd78-c776cf8dbcb9", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987600, "uuid": "8719be9e-7d66-4f84-a230-a8b43b03be33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987600, "uuid": "0050ac6d-9c10-4281-b742-e2be94352f90", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f27b1b-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924453, "uuid": "cd9c3c80-7665-4b39-a3d7-c07c69049172", "comment": "Malware payload", "value": "29c61c771f18027c0a63ef41e57f7e50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924453, "uuid": "f18ee3d4-c5d1-47ad-855a-5bbdc734fd16", "comment": "Malware payload", "value": "7405117e8903bea1f4a641f74e1b7b208ac70d74971cc668cec63bcd2f81d64a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924453, "uuid": "b8f0e893-8006-48c4-b209-06b4657cddfe", "comment": "Malware payload", "value": "4a9b7af46dab7e098ae8e7e2de0fba857f5b8cdc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924453, "uuid": "be23a48b-d025-44a6-95ee-bedfc422e447", "comment": "Malware payload", "value": "2262637be9789a5b2440e0779ffad1103f43e4f946a55cd198f49ccfb71abf257f54666163866f939949fff41d830024", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924453, "uuid": "6b130622-055b-48b4-bdeb-69dee86add95", "value": "T127E0868A365120D38D2CBF04F83B46A46485B3C030704724359B6665D4A46403860F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924453, "uuid": "56408ede-b8e3-4252-a330-f15282cc4946", "value": "6:hoMY5yMLol6B9LDCa0LKi6B9qxkICB9LfHW0XBUA:rY5PolqVDCa0LKjsCJfpUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924453, "uuid": "3989c20a-b667-46b2-ac92-7a14d91d7ccb", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924453, "uuid": "728ebfb0-462d-4c1d-85fd-9998f6191b8d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924453, "uuid": "c1acd362-78b9-4a6b-a609-e7056bb1805d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d17453-3f6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776987077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987077, "uuid": "1ea23a65-8dfa-4948-a2d6-97b385998778", "comment": "Malware payload (Gafgyt)", "value": "457e9f4b2329439ad637caf445b38124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987077, "uuid": "d11627f1-5264-41ea-81db-508a0f795f73", "comment": "Malware payload (Gafgyt)", "value": "7449a304de65439af29f8235f840bde766e5e2b4c042e8577de44f61cc29072f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987077, "uuid": "2cffd4b2-201d-431b-bf84-a681a73fc4a2", "comment": "Malware payload (Gafgyt)", "value": "f4c7149307b9782ea75bf57be17b3c26679225b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987077, "uuid": "c02955ea-2062-4577-877f-a235e5e75454", "comment": "Malware payload (Gafgyt)", "value": "fc0c6884d1daff48150e05d50d1f04118885a0b87a4c516b59601e10c6cccd8c204bb0961222c765e32b84eb1883805c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987077, "uuid": "54dbe012-6d0c-4b18-a89f-b4578e3e93ac", "value": "T16C830888FE059B1BC2D371FBFB99028D772A1FA8D7EA311699317EA023F55D11939210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987077, "uuid": "3951f39e-10c9-4dca-8a5d-8e3f5dfbb997", "value": "1536:Tzzm8lxXiuBLD6ah6xYtLoOn4ufzSENe6vyQIoS/:SkLD6ahRtj7NiWS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987077, "uuid": "06e2ef53-fb53-4277-8717-e46bf4ae894a", "value": 87684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987077, "uuid": "0f3299b0-bede-4458-9f55-32d201df9271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987077, "uuid": "8f682e72-52f9-4512-9cb3-a0c1867bd20f", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe4a8d5-3ee7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776930157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930157, "uuid": "1508e9ad-b67d-4a69-a88e-e8c3b5040e43", "comment": "Malware payload (ValleyRAT)", "value": "84473b78763e8b3ad68347174dfcf644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930157, "uuid": "5ec09570-863b-4955-b814-e7f4c9568b5c", "comment": "Malware payload (ValleyRAT)", "value": "749c01f5ddf2911059eb795923b81fc605cbba51f3c683313253bf51e97960b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930157, "uuid": "6f1aacaa-4dcb-4202-acc4-543b1c46e74a", "comment": "Malware payload (ValleyRAT)", "value": "49d617d589d3acacb4de9a80bc8ded85e48e8467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930157, "uuid": "c090042c-e07a-4ef0-b32a-cbb11aff8c7a", "comment": "Malware payload (ValleyRAT)", "value": "ef4f06cb1b72398525150970505891c93f25332e83d4e7a84eef1ac89244195f96761792a447de54ac85fd0e61164330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930157, "uuid": "63cfc151-8da3-4e30-a98a-f01403945466", "value": "T1C8E37C2071C0C0B3C8B6553158B4EE769A3DF9701F245DEB63980BB99F342D29B39A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930157, "uuid": "db36b341-f187-48cd-bc2e-e3f7ebd2ff5a", "value": "95d95a460e8783695f0245e2dce92576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930157, "uuid": "4b08d76c-1bf5-43f4-ae76-5daba3d3b3f6", "value": "3072:wbxwRoe0/2/Qa52RltsA11W8o2zdpfw5MorHuhaNyUpFUJR38yt/tsTF4J:wyRor+/QOePsM82zPfwKIOhaxqFSuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930157, "uuid": "6ac388d9-e28d-4eb2-b8f9-9729b503c728", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930157, "uuid": "89c9065d-5c57-4a25-b9f4-9b63521c0f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930157, "uuid": "e15571cc-758d-4e5f-b6eb-871ad1db31fe", "value": "84473B78763E8B3AD68347174DFCF644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab6a718-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987594, "uuid": "b0041c3e-308f-4c0e-b5b9-ba7c5eeb87c8", "comment": "Malware payload", "value": "ce7eefd3cd256b4d36c1416356b3f236", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987594, "uuid": "17b0734c-b9fb-4a42-b416-ecaf7ccf1cfb", "comment": "Malware payload", "value": "74a77d5b40f5df3590ed281fd26d6f997a2b4196a71464e3ee10a2c4fa1a86d4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987594, "uuid": "4b338b11-c1be-4ca1-a3bc-eb360a7b5506", "comment": "Malware payload", "value": "c80ab947e4e312da8baab12b325349969db46f05", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987594, "uuid": "ed6c0c7c-0560-415f-8698-478a1be5bef2", "comment": "Malware payload", "value": "ff4919c6c07639625b15645bc2bbb2a06f1f59a91176e437f0c46adb334d0cf357b6b9038bd28071b43e6f5dde94dc25", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987594, "uuid": "25d01424-6e6d-4336-a3f4-3e6accbed4b9", "value": "T1E5D097036428A3000713C68854A2E2A88A9320006BB86AB6BAF2EA0735443F18667CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987594, "uuid": "52e9d071-d54b-4594-90cc-974e5c641efe", "value": "6:jeh281R3KuoO0cbcq3Lh8JUWfDyO1MNMLJZfRkzQHr:Sh281kuopcFbGOYDp1MaJZfezQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987594, "uuid": "eea81aad-5621-4a75-8632-cefc29d5176d", "value": 246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987594, "uuid": "b23b4266-5ee0-4933-848d-924f7712e897", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987594, "uuid": "b3578203-228f-4f43-b133-85ff7eeb9714", "value": "VnLmQpo750.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cd0e97-3f1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776952875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952875, "uuid": "10ae174b-fb21-4fe7-983e-c9f547448a9d", "comment": "Malware payload (Vidar)", "value": "306e382151c86c1c2022df5c2070b6d2", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952875, "uuid": "1b0955fd-4ffb-4f68-b7d2-d3408a25b927", "comment": "Malware payload (Vidar)", "value": "74a894f48bbbb4457c35186490749e8eb43d07aa67d2ce9fcee7590d5d730eca", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952875, "uuid": "5bbfcb10-2969-4b41-b3d9-0a1fe0aa8e07", "comment": "Malware payload (Vidar)", "value": "7b87176df5f4ed1eed621c838cf493db27503462", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776952875, "uuid": "4720dd64-0aab-4984-ad7a-c1d6407faae8", "comment": "Malware payload (Vidar)", "value": "ec55089e6d54a73608b42035921064b8d623b9272078c3376c7a7389fa77e695c1e38ea4413cefa64880d4e71ee37800", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952875, "uuid": "9d96c178-6691-4e11-8a49-ff8a11885b5c", "value": "T1B6958C07BCD108BAD4A6A3328DF661927B72F8190B3233D72E50A6783F7A7D05979744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952875, "uuid": "e8fdcbc9-107c-406f-b7e3-c26a75d8289b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952875, "uuid": "f6f70e7c-0e00-4db8-aaac-227aa08c4ebe", "value": "24576:kskZpRrcVXW98ywSB/XUigyDj634OTBoziO7n1I3cqA2hZQAjmGFWPH:kskRrb98uBrTbHPS3cB28Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776952875, "uuid": "23cfa8e3-5859-4386-99b9-3976f69d7f58", "value": 1975808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776952875, "uuid": "39b661ee-f827-4cab-a2b6-d7cdc63b2f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776952875, "uuid": "233ca8a0-5082-46e0-849f-51eb2ff80789", "value": "Set.Up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc948f2-3efc-11f1-a769-42010a9c0008", "comment": "Malware payload (GoGra)", "timestamp": 1776938903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938903, "uuid": "31b0dbf1-b1ff-4ec1-98a1-bb60b6ff3f12", "comment": "Malware payload (GoGra)", "value": "d69cc848443b63eb0ae8d05a6ecfba5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938903, "uuid": "97f786bf-b2e8-4587-a7ae-509f4232ea7a", "comment": "Malware payload (GoGra)", "value": "74ac41406ce7a7aa992f68b4b3042f980027526f33ec6c8d84cb26f20495c9dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938903, "uuid": "70651c6d-ae88-4b33-a4ab-9653c06d7416", "comment": "Malware payload (GoGra)", "value": "a225c68ddfaa81bc3f13bbfc65a85b4e047e8aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938903, "uuid": "9e83498d-2555-4f6c-aee3-41b573c3c5c3", "comment": "Malware payload (GoGra)", "value": "16ec6866b9ade88f4bf3a7042d346b908ceb7636f602f0c5279a97249c61fac34485613d315eb4a1492837962c13c7ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938903, "uuid": "0aa85ecd-bf07-4d40-bcb6-23fa5a4e495e", "value": "T112762811FECB44F6E5031E3109ABA26F63315D058F24DBD7EA447F2AFA3B6910936219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938903, "uuid": "0203c8df-f884-477d-9ce2-47ded0735463", "value": "49152:FiWCtw/c7AY0f/RumyvpkqahV8sP5nea3cFYmxVnfa6++t7h7qz5lR3SHHFxMAp6:ArtUn8myBghqsjm/nfVHONGMnE8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938903, "uuid": "a03df208-f48d-4694-b167-86e91efcdf53", "value": 7708856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938903, "uuid": "2bc9aff3-c130-43d5-92c2-3d7457042b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938903, "uuid": "ae0dbd4b-35ef-4d88-bfbd-b7e3ee80730a", "value": "74ac41406ce7a7aa992f68b4b3042f980027526f33ec6c8d84cb26f20495c9dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deac7e9f-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776926665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926665, "uuid": "2420d7f0-85f5-49ac-b011-0e2d537b0eed", "comment": "Malware payload (AgentTesla)", "value": "1bd96c0f234096eee99f7fbc6c909e7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926665, "uuid": "1f2b79c0-0efa-44c7-83db-255fd983f569", "comment": "Malware payload (AgentTesla)", "value": "74ac43c8bc7fd48d45220104ba17f2483212bdb4a4edf0c3471b339fdfcaea59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926665, "uuid": "431d5117-49ed-46f9-ba86-a384f7bc181d", "comment": "Malware payload (AgentTesla)", "value": "327177eac25a68148b27ffe1c834d5675cc4a130", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926665, "uuid": "712ca25f-ec35-49ea-bfa3-2c53dfdc5e3a", "comment": "Malware payload (AgentTesla)", "value": "9837ccf086971d33003d17398c66a1039f84751fa8a4b36e587b7d37f2312bf109ba23831e9c3192221834de8efea1a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926665, "uuid": "ee2f862a-80e0-4932-ada5-7f3e012f7400", "value": "T1BE255A60E6DD8A10CAFB6D312BE45D55EE3461E351204608F4EE3627EFB390349773AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926665, "uuid": "1f12ee24-e701-45f3-86f3-b66f7109ea63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926665, "uuid": "27030919-2505-4912-b84a-d4e64d44d098", "value": "24576:wXnRe8m76sDNxSkqj1i+WKD5Fp1UPVhFK:wXnRe8uRxSkqjoK1pihFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926665, "uuid": "994a0cf6-c30d-451f-91e9-92226a5f24c7", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926665, "uuid": "901eaee1-f57d-495f-86d3-84641e547f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926665, "uuid": "9447aade-be1d-46a4-b349-e0e613cbc3b3", "value": "74ac43c8bc7fd48d45220104ba17f2483212bdb4a4edf0c3471b339fdfcaea59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f331f94b-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776928847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928847, "uuid": "8471fc44-5833-49b2-8de8-a1c0ae5f68e5", "comment": "Malware payload (CoinMiner)", "value": "9f47467f2aa4eede92ac5eee20d42fda", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928847, "uuid": "5b613340-b2a1-4629-8994-1f9f25522902", "comment": "Malware payload (CoinMiner)", "value": "75a2724ca85cc22ced6fa434683d4be11ac2c71469104933128a91ed72e5e0bf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928847, "uuid": "1b682bcb-af18-4f02-b07b-b6347172500a", "comment": "Malware payload (CoinMiner)", "value": "1cdfdd53105b97e03878a599dfe3161106cb2130", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928847, "uuid": "9063d3ab-e3a1-414f-bef8-88aa87b563da", "comment": "Malware payload (CoinMiner)", "value": "04a9cf38e7486bdb20f7d6adf44d08f601e00a2dacc67d7caef64bb0d8bfcff2106dac9e239d431af1a4d5281ae9df89", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928847, "uuid": "18caaa63-b618-43fd-bd3e-dbd7efe1bf23", "value": "T15F26336A6283FB65F4D33BBA9B1E35194941F32D3EA4C20A4676C344F9431E33C9E496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928847, "uuid": "66f9fe37-62ed-477b-bf76-e5ada245531d", "value": "e3670f1fbea1791ca90fd04ade895071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928847, "uuid": "6390f608-f53f-434f-9652-848fb4452978", "value": "98304:vkdh9O/i4UkL3v67jWJk5ObIwR8m82Td5lrJVFbJWc+U:cd3yi49LfyEkUbl7LAc+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928847, "uuid": "f6addfd9-3887-4f13-b908-6eef8a89b0e3", "value": 4851200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928847, "uuid": "de4e3edf-6d37-482c-a006-d613f83c3fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928847, "uuid": "70509e5d-23a5-49ca-852d-ebec602d0c23", "value": "SecuriteInfo.com.Trojan.Inject6.39307.21668.13214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17349daa-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976152, "uuid": "8827972a-cefa-4986-8da6-57448f15d4a6", "comment": "Malware payload (Mirai)", "value": "32f3f697cf0cfccfb76b4c1c45015cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976152, "uuid": "e7e6d2e3-368f-4327-9da7-80d1feab25d6", "comment": "Malware payload (Mirai)", "value": "75e7200a68f1a66a9f86e4a2c370a21e70926d2ad0c65482ee4b0750a3ec1ea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976152, "uuid": "8c83ba0f-eb37-4642-a0ca-d7d5b1493276", "comment": "Malware payload (Mirai)", "value": "7c454f0cd2cdeab0e9eecf6f8574a680361562da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976152, "uuid": "fc48c34d-50e8-4b59-9a9f-8ed2236536dd", "comment": "Malware payload (Mirai)", "value": "6388283491adc43e7ad400be6aa6ec09d8d4e41e168a499bb8b1140aaf53a067cef10f81fae8bfa5bf9391d5f9c22f23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976152, "uuid": "6c3d6847-e718-4066-9efb-6a29764ab1a1", "value": "T1B8432B95F802DE7DF80FE67D44164E09BD3063C261830F2627ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976152, "uuid": "81aeb81c-66aa-4644-96f4-5c6569c08c45", "value": "1536:/+dPsTgnLbMuv5tnbaXnb7f98V8TWl9ouSQy8fNLsA:23rnbobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976152, "uuid": "f6ce290b-24ec-447f-8f37-e7f748c1e95f", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976152, "uuid": "e4b50256-25b2-4ba9-85cd-ab048e2eed84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976152, "uuid": "fe261b85-c20d-4382-9a27-507a2a83a411", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1ae35a-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1776930847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "f7ca6c00-6e7a-476e-85dd-3f9ee1b87521", "comment": "Malware payload (QuirkyLoader)", "value": "ac92caca2a54f36edf3b984995916114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "6acb6eeb-b32a-47fa-a864-677a861dc5dd", "comment": "Malware payload (QuirkyLoader)", "value": "75f71dad42d6f91dbafeedeac6b512eb4f870074b0d0267feefa4eb26e334448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "fa4f0d9a-7f51-4304-967c-d1ea27af0a45", "comment": "Malware payload (QuirkyLoader)", "value": "d8744d7771bcf95bc6e0ad37f3a11fc77d0a3f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930847, "uuid": "c4eb9f67-3852-461f-a34c-be1dc1232839", "comment": "Malware payload (QuirkyLoader)", "value": "2d78040119a32d8ed43f41dab95a62db21cfd239d432fd5a407c41d79136df13002372383d8c53ea3126f1ecf766804f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "66ae44ac-0695-4d9f-a14b-ec01630293aa", "value": "T1F565BE5AF3C86AECD117C939CB55A232E2B274670762B5CB0B9AC3051F77E905B3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "e51d00f8-56a0-4210-a153-621bad9c24be", "value": "fd433e40cb5fd008e120c8bbcda743b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "4599bfc1-cd58-4e44-b0f4-165d88e4e9c3", "value": "24576:cD9OYZGcYOS0jbBczay+OmNtmSfo7pLcQ64HVSPNQRiDXGcuvkmvkOE:cD9OYUdzaZOmN5fo7l/HVAWRiD20CDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930847, "uuid": "4c911507-6cad-4f4c-b74d-3b0d2ea7aae8", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930847, "uuid": "019ff4db-f6fd-4a35-803e-78d7ff891766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930847, "uuid": "f33e22da-82fc-4e3c-ac6a-e97ae881f832", "value": "msedge_elf_6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f6be9a-3edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925448, "uuid": "6b69eb57-f1c1-4478-a731-ef748950ddc7", "comment": "Malware payload", "value": "9d4881976898c511a4097af437783be2", "object_relation": "md5", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925448, "uuid": "11a338a5-bc31-463b-beec-c9f0bc02218e", "comment": "Malware payload", "value": "769d2fbea98e5dc9dcf6a8e6fd4f9e7ad9e75944b5bfd5f1086f68781ebf0805", "object_relation": "sha256", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925448, "uuid": "2c5ab90a-bc4b-48a6-8eb0-4c50be66b458", "comment": "Malware payload", "value": "9b98e13f0813b609b73b81fede521d854460c87b", "object_relation": "sha1", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925448, "uuid": "5988c204-6861-4be5-bbb6-63a2fd6ba22a", "comment": "Malware payload", "value": "d3c9786d78f08e06a0c7f1214c118310946d18f8c1b0c568dd2706902f09c43be77c03a5b6f4a30e86b3f2ee84748820", "object_relation": "sha3-384", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925448, "uuid": "c6827e52-06de-4eaf-a36c-d3a64a495ea7", "value": "T1DC5722162EBACB8F533C7874E99F0FBD0DED8E0BA818B56B7494C847D147A46189E11C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925448, "uuid": "05a6a41c-77ba-4974-901b-222aba010049", "value": "49152:683LgpyWy83LgpyW583LgpyW383LgpyWz83LgpyW683LgpyWk83LgpyWq83Lgpy9:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925448, "uuid": "5db0b418-d7b8-4ec7-9523-97416f0cb80e", "value": 28812405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925448, "uuid": "e28a5022-7855-418c-ac6b-2fb5350fb09a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925448, "uuid": "d7f8831c-94ef-4870-89aa-0e5ef339dc7d", "value": "769d2fbea98e5dc9dcf6a8e6fd4f9e7ad9e75944b5bfd5f1086f68781ebf0805.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c57fa8-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924471, "uuid": "0d6ae98c-5152-4adf-880e-911951ab7b95", "comment": "Malware payload", "value": "b1e43a8c08b432c91476a2a4fe6a7b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924471, "uuid": "03481fa7-b8b2-4948-895c-37674b6c1624", "comment": "Malware payload", "value": "78484c96f932427126bd3345ce6978793c2325d8e8e56bc43bef2e93bd7f7139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924471, "uuid": "9694beea-14b2-4e7b-8618-c6e39c6fbc42", "comment": "Malware payload", "value": "f45c2e436ee541b9b01aea7754a0169455f2ff6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924471, "uuid": "56b9654e-3366-4e23-997b-44b4e743753b", "comment": "Malware payload", "value": "7a7e7cecf4935c90a3613f2a9bdedc169c9b70a2f3019db504fba2e35353c92ba85ba2e5e3e0bc610d499c9548b3d5d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924471, "uuid": "d169bcb4-c804-4add-b9a8-a414c1da6373", "value": "T194A34C8EBB569E42C59C0A77C453600C8068D4A6E927F37F65C50FA46F729CAC5CF8D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924471, "uuid": "0c2c5996-b761-4af2-9889-86faf3b65e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924471, "uuid": "95d3b512-df35-4e52-bd79-c6b7bcdb470c", "value": "1536:3T1hIwI7QQDh4VmjceWigqgSLlNf4CdBlqfX/i+RIG1Uw:9FQD9Wig8mQS//i+KQUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924471, "uuid": "caae8434-6f89-4781-bee6-413cd747e2ea", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924471, "uuid": "bfd5a6b0-fbaa-4853-b161-0e9d7253a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924471, "uuid": "324690a3-14a0-4630-8bbd-e1a5ba055724", "value": "78484c96f932427126bd3345ce6978793c2325d8e8e56bc43bef2e93bd7f7139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f79ff8-3ef8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776937413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776937413, "uuid": "22d54a74-77b9-47e6-a3c4-ba712c544737", "comment": "Malware payload", "value": "60d5038ffc7b41354656eb5f1a910394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776937413, "uuid": "7f801c34-8024-41ce-97c1-59c1f1fd1e1e", "comment": "Malware payload", "value": "7860dd085d9db6ff2fb594d9bbca23095779dc2bc7d9a201f76d5e0a285549ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776937413, "uuid": "bdf5164b-05dd-444f-82e7-6b7763df70d2", "comment": "Malware payload", "value": "dbe39a0de79da824dac3668ea13a046003e285cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776937413, "uuid": "5419f909-5e76-4c66-8ff6-c4b1e71d87f3", "comment": "Malware payload", "value": "974bfcb3b087b98226eae2c8848e7e257beb8c8ecfe98fb7eb9ba7d38f474a721af7c9aa3bb22530f0a79dd6746173b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776937413, "uuid": "8d981edc-4f92-4c4c-ac2a-5f8ccc5098c9", "value": "T12415948926DA057ECBAFE33A8602305FF6203BE1572007A7165A4F4A3B7797D663D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776937413, "uuid": "10f86be0-9769-4671-abab-60728c7ed24d", "value": "dec7b520a287ad921d01a533f9a156fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776937413, "uuid": "3f9617f6-b5a5-42a3-9d03-d5cc9e6b57c8", "value": "6144:hcSMaRJcpJxutOGFO2wGaXgi5XK1LA395lfAbJFm+j8DTClTvQ2b+GWIPhF98dBZ:hrROp+4mh+dK1LA3WbJxTohih+jiWVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776937413, "uuid": "1aa3df5a-8864-4a28-a728-8c75530bbc8a", "value": 942320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776937413, "uuid": "979024bd-3684-4220-b729-a873c8608e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776937413, "uuid": "76d7fede-c51e-460d-8109-15482cfd762e", "value": "image202604226896.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b645a-3ead-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776905041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905041, "uuid": "41438b15-6e28-41d3-bf50-906b46c80e6d", "comment": "Malware payload", "value": "3cde10bb32dc435b1a804e1471fcadba", "object_relation": "md5", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905041, "uuid": "67bb68ea-2f81-47a1-8948-8ece0344d312", "comment": "Malware payload", "value": "78c16b5e046f70bddf541920936358461014438a983c465cc24977cb7840d4fe", "object_relation": "sha256", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905041, "uuid": "c54ddd2f-e3b2-404e-815d-9eecbd92a198", "comment": "Malware payload", "value": "120e40fd0108e0e96cdd72fae3baa7c668310674", "object_relation": "sha1", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905041, "uuid": "ebbcb0f3-cea0-453b-a67f-00e2b5b9c40e", "comment": "Malware payload", "value": "22031a03bec6ca3fb30986a962829c96835055c083012bdffc4d4ee1dd405fa12b92fc993be78820c952143275c0c5ce", "object_relation": "sha3-384", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905041, "uuid": "75fba35e-1601-40ac-b0af-870ba0984cc4", "value": "T1353633D7BC43AEBED4AE4EB48401E40C4635A7091F04D273225D6B2A76A7F63B7D610E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905041, "uuid": "c3d9435e-5046-4372-afcc-f4e4f2805440", "value": "98304:sqgqqNGnFqoHEh0xUtYlW7lF0VOpaLEHkf3wBHnSmv6yyGNwCFRB:s0kGFqovPw7QVOpNHowlXy2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776905041, "uuid": "52d989f8-df7e-4aed-9cec-84414b4f40e5", "value": 5149184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776905041, "uuid": "b3fa781d-3ebe-4a2a-943b-cf862e34fcae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905041, "uuid": "42c6734c-6001-4edd-9422-8f40ad17ea7e", "value": "AssistenteEmpresarial.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6c72cf-3f13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776948779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948779, "uuid": "662fbe6d-0ef7-4cec-bb4d-d29e1c04c23f", "comment": "Malware payload", "value": "4e58ee4eadb2b6610567d710833d1941", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948779, "uuid": "3a4ec6f0-7244-43a9-bcfc-15d7b04f056e", "comment": "Malware payload", "value": "791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948779, "uuid": "0cd668e4-602d-4b14-9a8c-f507942eb7ca", "comment": "Malware payload", "value": "ecbbc0bbf0b4e7f67d7f1433efa6ef878e5af545", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948779, "uuid": "7c53471c-a3f6-4d56-bdb5-f36e80a39ac0", "comment": "Malware payload", "value": "f8aacc8631355c038ecee2ca334a4ff5c8ed531bb2c32224930d58780fa53e634efea04cd254e9215e7bae0a37c39a04", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948779, "uuid": "c88ab749-0091-4948-aefb-a617af4f044c", "value": "T10FA37D41F3E102F7E6F2053100E6662FDB3663289724A8EBC75C2D529913AD5A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948779, "uuid": "12f7178c-4194-4522-b6b6-c11951fddf13", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948779, "uuid": "ab633623-67d3-4236-9251-447be1b94f06", "value": "1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf2wfd16VOU/EOOS:b7DhdC6kzWypvaQ0FxyNTBf2Cd12/EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776948779, "uuid": "c46f56c2-4e0c-442f-886b-c0b92d51d075", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776948779, "uuid": "a6f9ac53-0bbc-4584-952e-2de1f7ca459a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948779, "uuid": "ceffaf89-dd30-4731-b528-4869ef5e30f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8c6389-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944300, "uuid": "12629d58-b46e-497c-a88d-707877bbad43", "comment": "Malware payload", "value": "cdd065c52b96614dc880273f2872619f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944300, "uuid": "5515b90b-0704-4527-8bcc-24c9a79aae4c", "comment": "Malware payload", "value": "7946a2275c1c232eebed6ead95ea4723285950175586db1f95354b910b0a3cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944300, "uuid": "7d8ed1c4-401a-4299-9f2a-aff4d4cedcc7", "comment": "Malware payload", "value": "0516b1e97b73f371bdf92a7e00fb5ded63cce485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944300, "uuid": "555f6d33-af47-4004-a4f8-fc4c83e26d9c", "comment": "Malware payload", "value": "c6f69a72f1bc14f389847612d33604066dc9cbaf6ac0fb9feb750fd5c25a0462c82e788bfb5cd847f3d10be6babdfa30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944300, "uuid": "75d651c3-8c80-43b6-b1df-3073061890bd", "value": "T16996FB03E63361DEC5FAC139952A7323F8B03CDD8635EB67455092A22B74B64AE3DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944300, "uuid": "24e8eb6a-d4fe-4fd7-80d2-e358090ab473", "value": "7fe24ca260b79ba559ca8fcd686cca98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944300, "uuid": "6c05bcda-730b-4b11-ba7b-dc14ef8a9168", "value": "98304:VE8VV6+pAls2VOcDZDipfY+M0RbTtf4sYA81CApOwXmlJM8BFDc6D:G8H6+KsGxZDZetWj1CAD8Hg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944300, "uuid": "9ea571e9-d6a5-4439-9c11-7fdd6da9f0c4", "value": 8980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944300, "uuid": "8c5403a9-ea86-42f6-96b0-988ecfce2975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944300, "uuid": "130b5503-4dfd-4a3b-a7ef-2696ffa0ee63", "value": "7946a2275c1c232eebed6ead95ea4723285950175586db1f95354b910b0a3cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792ac355-3ead-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776905020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905020, "uuid": "b66cf34e-6788-4bd0-8305-adbbee874d56", "comment": "Malware payload", "value": "a7d7b83ddac81e98414ff17147a75261", "object_relation": "md5", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905020, "uuid": "a4b47822-af77-428f-97e2-d028e31b11fd", "comment": "Malware payload", "value": "79b4c1dca605247eeb976509daa532e936627a2a63ecf640a2f3e3b401fbd535", "object_relation": "sha256", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905020, "uuid": "e0e507b9-065b-4fdc-9962-d9d90bed6355", "comment": "Malware payload", "value": "e35466d7d01a7a75c949b0ecf77864e14db8ff77", "object_relation": "sha1", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905020, "uuid": "576a115c-71b3-4a2e-a72a-1edaec182fbd", "comment": "Malware payload", "value": "6f1532d9ecec9af23785967e896c50e4285291ae5dfdd67bd90d249493816a0c9fc6115363eab2c85566dda326239085", "object_relation": "sha3-384", "Tag": [ { "name": "claudermm-server-1", "colour": "#7A9C57", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905020, "uuid": "c4d71c7b-3eca-4489-a3c9-e68e641e4c83", "value": "T1B33633D7BC43AEBED5AE4EB48401E40C4635A7091F04D273225D6B2A76A7F63B3D610E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905020, "uuid": "28bc2f2c-00b0-4ea7-bda8-3521ccfa95c9", "value": "98304:sqgqqNGnFqoHEh0xUtYlW7lF0VOpaLEHkf3wBHnSmv6yyGNwCFRI:s0kGFqovPw7QVOpNHowlXy2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776905020, "uuid": "f7136ef9-b89b-4bc9-b382-0ac29e96f4d5", "value": 5149184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776905020, "uuid": "6f86b200-744b-42c5-948f-037c53e16c0a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905020, "uuid": "c3508d5b-868d-4d1e-a1d2-27e9201ca99d", "value": "Nota_Fiscal_Eletr\u00f4nica(NF-e)-xml.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e90c194-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944812, "uuid": "2493b3af-f19b-43c0-b4ae-0edc04b90824", "comment": "Malware payload", "value": "591e46e6b9e34e0ca7b71a1783c268f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944812, "uuid": "0c6c0814-eb5e-4f42-bad7-ed570379d5a9", "comment": "Malware payload", "value": "7ad8c45da6963d0b89ea815be9613e514eb46503a9411bd10aaefea4b4a704f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944812, "uuid": "a25bc26f-7899-4775-9034-3267b39720d2", "comment": "Malware payload", "value": "c18338ce9caecf6280e9ea0b2fda527eca132a81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944812, "uuid": "b1906c4e-dfdb-4f2a-a7a9-674006596cec", "comment": "Malware payload", "value": "a351533c8ef55ce815391f1a3d4dc9169dca7ecd62db3b2ce1a90236699190881915b70f4d885ce8ceca87789a7b4e8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944812, "uuid": "97884a8f-d775-4877-b355-99369dad8690", "value": "T1297136079BD48527E0A74B34AEB3875267B4F8904F77473E04904214BCA17A41E71BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944812, "uuid": "dd55eeb5-a3d2-455c-bc69-a85a562a5efd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944812, "uuid": "7f9d080b-9794-4320-ab93-b23584e59787", "value": "24:etGSW9Rz1Q5P7ZwuIjkWNk5UEtkZfb65moCx5FDb2WI+ycuZhNyakS6PNnq:6WsZeJm5m/Fb91ulya32q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944812, "uuid": "9fc7def9-56f1-476f-8afb-abda025a5213", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944812, "uuid": "92bd1990-5d64-45f6-8630-8aed3a96e619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944812, "uuid": "8ee74117-fb39-4e5e-96fb-b72dc23c8258", "value": "pdr4kx4k.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed16d42-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934423, "uuid": "e96031b4-2c79-4962-b8c3-6aefecf04b2c", "comment": "Malware payload", "value": "fd1ef8429627e6616e7ea51f071e3656", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934423, "uuid": "4e036edb-91c6-4fa5-aefa-1b09d6061dad", "comment": "Malware payload", "value": "7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934423, "uuid": "43ce865d-b4ce-4e5e-9dee-4ba69220492a", "comment": "Malware payload", "value": "064b5bea47c79598dc5db18dfa6f6b2d30f38a85", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934423, "uuid": "4e63fe98-92d1-487d-9956-056a93de7522", "comment": "Malware payload", "value": "f2d8eb51b15e16b17522e3255f01fcb22ab0b1c2959dccf891267417ef87bbaaae57181853dc2ad1e739c609e66e4661", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934423, "uuid": "4d09008d-0aae-4893-8d7c-a7f1e1e769d1", "value": "T1FC556E247A022EFF5BB820C248C6851C663822B9D9682DF579CF4C923F0D77527B79B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934423, "uuid": "87e96c5c-ee93-437f-8acb-25870e91524c", "value": "12288:YUC4HZQmeamlHrGo0SVLLvQzUelI/6jfpLmQqV+Vv7Ru9z+kitaVG337xGXRGED0:M4ZRsNkUiffI0RVki08H7VG9CxCWJs1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934423, "uuid": "8e4e525a-c349-4d23-be9e-84587f830a90", "value": 1321114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934423, "uuid": "94f52816-4460-4225-a404-dd9473b69f1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934423, "uuid": "917745bc-eede-4ef9-a48b-eeee2f981bdd", "value": "7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73669984-3f16-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776950108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950108, "uuid": "36721026-99eb-4830-b006-78640d9af008", "comment": "Malware payload (RemcosRAT)", "value": "2e84c7fcc36aa50807401908d64cbbc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950108, "uuid": "aeedaa2d-7cc7-4bb6-931b-a3a13648a2cd", "comment": "Malware payload (RemcosRAT)", "value": "7ca636f58225affda4c2e23a3476ebc0a557cfb2ffe50383003a9a13d87fb0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950108, "uuid": "23e3bb59-ef69-4b65-8b23-75ef25754d0c", "comment": "Malware payload (RemcosRAT)", "value": "9ea3ec98c95bd4953eea4aa7cba4acab20ba2f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950108, "uuid": "63b99521-fa77-4c31-a3e0-3d5bd457201c", "comment": "Malware payload (RemcosRAT)", "value": "628d267c33e1fd5cfeec1c0bbe1c0866c26f6e69b0942a3cfd17853652ed298d25402366b2fdd89aa27d0a4a33e7e84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950108, "uuid": "1ec06d7a-b07c-48e2-ad4d-48df4d732ac0", "value": "T16A565A47EC9155E9C0A9E13186679252BB71BC485F3123D32BA0F7382F76BD0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950108, "uuid": "0ebbd44d-67d5-4d09-b069-858b734efa0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950108, "uuid": "2124933a-3915-405d-9ad8-00974f0d29c9", "value": "49152:nSjBIgI22zvj7rD3rSnk5yd1fLe26ZP1VzTGBkxmXdHR2sqv7lNxZ4oW2071/i/7:nk0OZOR1tTGyIyE5OULEnMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776950108, "uuid": "d1bca055-ab20-4b07-9c34-60a5f84717cc", "value": 5993384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776950108, "uuid": "7e3d180b-f312-40e0-805a-f0493c8d7c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950108, "uuid": "21434f98-7e63-4d1a-aea7-61a4b0f31238", "value": "11111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e86880-3ed4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776921893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921893, "uuid": "5043670b-d0e8-4dc3-bf31-cd2fd9b1e37d", "comment": "Malware payload (Mirai)", "value": "b677a3da58b1fe98afbb8343c5f55d83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921893, "uuid": "09598b73-4a7c-4d18-a6d1-c547fe25328b", "comment": "Malware payload (Mirai)", "value": "7d1653c276e96ac9409ce828d74ec8320bdd03952e94dae482a27abedb717a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921893, "uuid": "7e881c9e-d66d-46c1-868b-7c42b4a30348", "comment": "Malware payload (Mirai)", "value": "614930a7eccde840fb776deb46fba62f54b0e265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921893, "uuid": "1762dace-7e8e-4851-8300-e07692d48705", "comment": "Malware payload (Mirai)", "value": "2d07b4aa91ddc1f62c0802da0cc98e0b5ffc3e70cddd2b9455da9f55c9ed0b86407071475fc5f6c08999b1435a8a57a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921893, "uuid": "10d10ffd-8f7d-47bd-902b-d261d92b0980", "value": "T170330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921893, "uuid": "77d92fa8-efbe-44ea-a9fb-7b7d98744c6a", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGB:r/hqaJMDg9eqK806MHdkfQX6HuCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776921893, "uuid": "31dedd08-0759-49d7-a88b-f540237be1f5", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776921893, "uuid": "78d84f5a-21d9-4fc5-bf37-fe1c52251642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921893, "uuid": "55c63a82-bd89-404b-9d2a-ec3d3724e254", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379acd7e-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928103, "uuid": "4ac75729-b487-4d4c-8b67-add136d7900f", "comment": "Malware payload", "value": "d9b157c3424b221c33377c8383ed46b2", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928103, "uuid": "66c6e908-856a-42a9-8149-88cc2a4d3b92", "comment": "Malware payload", "value": "7d349ba8cd4e41ba6ace5cb6b994ce2afc2762ff3e08bd324a4acd07f8ada227", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928103, "uuid": "5d05336f-eabd-40a5-bb04-f9695cca0041", "comment": "Malware payload", "value": "fbe1f0e5014f7152ab49d4b335710c7c35de6c17", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928103, "uuid": "6f2e473e-3242-4b5d-aa89-8741d250a831", "comment": "Malware payload", "value": "8fa7c7e6265d26982ffa0e79599bca54f70503ec654d576b380478b50e2125f4e723cedcd56495dc23a2a1128a093b39", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928103, "uuid": "3267fc0b-328f-49dc-acc0-064c77e27ea2", "value": "T12727230ECE197D6F01B8172C3C7B4FCD1D979A89281AEC9472F794A4F11E22AF872255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928103, "uuid": "fefc5a8c-6068-4356-b168-6b9210c6fdc2", "value": "49152:qnMdq5nMdqVnMdqBnMdqXnMdq8nMdqKnMdq5nMdqlnMdqHnMdq3nMdqPnMdq52n8:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928103, "uuid": "580b526d-2a5f-4175-a038-d27bd1e37803", "value": 21371507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928103, "uuid": "8a4ecff6-44bf-48bb-84ef-9868c1cfee94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928103, "uuid": "14f6169c-5a56-46d2-ae49-9081fe4e4b3d", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fda7208-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928090, "uuid": "15837064-13a8-464b-8327-08a9958746ca", "comment": "Malware payload", "value": "a5089356832e906727cf8a8dc9c71af8", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928090, "uuid": "0043b6d0-3a95-46e3-b316-a7b161a10fff", "comment": "Malware payload", "value": "7d696abc57efbc384a8c11f80387ec7f1ae7f89a5a7527b86897519ee731849d", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928090, "uuid": "204ab532-5520-4390-b9b6-e1d5962fd0cc", "comment": "Malware payload", "value": "0636e3e634b07739b09e27a339c725d933ef7581", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928090, "uuid": "df9a8f24-8604-4feb-8012-be9088623162", "comment": "Malware payload", "value": "7eda865de73ca653708299078b8cc503a2ce12f8960e8c6adaa3a86536ef48a85b7601aeca7257e6f8f18593eb0c97b3", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928090, "uuid": "56d6ed0b-8fe3-45db-ae55-a911f6e29735", "value": "T1A927230907248DB70ABC52AD485E0B6E2DD4CD91C157AA35A2E77993E7FD63F0B8F060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928090, "uuid": "e9c2db3d-7ad7-4f1f-ba8e-2612355def46", "value": "49152:S56BKT56BKZ56BKz56BKO56BKC56BKo56BK+56BK+56BKN56BKE56BKw56BKEFu9:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928090, "uuid": "2ca2c24c-04e4-45f9-ba99-021b6f17ca06", "value": 22091516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928090, "uuid": "19987237-d23d-453f-8823-5c354d0be3f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928090, "uuid": "5a319b90-6434-4eff-993f-a2b622817bc1", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf8cb78-3ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776912405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912405, "uuid": "78cc2458-d9bd-4745-a92e-4a2cb6cd19c5", "comment": "Malware payload (MassLogger)", "value": "cb3af8617b37c043b9935a19ee2d24c0", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912405, "uuid": "e703fc7a-8f43-45b2-beb5-a93145848847", "comment": "Malware payload (MassLogger)", "value": "7d8cf5a10104f02491f52f8d7314c729d30cdb469f18ff8c2f0766faf11c2c00", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912405, "uuid": "a130665c-2a48-4294-b361-642695ddbf5a", "comment": "Malware payload (MassLogger)", "value": "4510fb16cad04daf8fab3f7b5d6077b75d447944", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776912405, "uuid": "fd208179-d052-4929-acb3-bc9ef0507980", "comment": "Malware payload (MassLogger)", "value": "63278aaa498fe8326a21d92c2212efc96da2ec5aaa66e930ce26b1161cc6afaf6713ee9a58b345d772a2f276770aeb72", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912405, "uuid": "d45b1c90-aad0-45f5-a156-a7c22a0ccafd", "value": "T11A041385662DA4655271F11C34D733EFBD03B1C1CD8BEA82B2F0D240ABAFD584BA5D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912405, "uuid": "30232a65-d44f-46dd-aeda-73a41dd5d6cf", "value": "3072:VNbcA9OG3TdZr8Z3TzNnotA06CYvqCFLkj9oDpqqJKsRSQeMTUxmeFgo4fsROaMW:VNbtEG30jRo206CcqCFQj9oD5suTwmeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776912405, "uuid": "e038fc8f-f49f-409e-b572-14872357a739", "value": 174653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776912405, "uuid": "eadc18fb-c75a-4cc8-b047-9b812398003a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776912405, "uuid": "384ca7de-cc6b-4938-a02d-c871f4e855a9", "value": "roughly.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d98359-3ed4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776921951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921951, "uuid": "edb05e13-3562-49e6-b8b3-a5c2596bcf64", "comment": "Malware payload (Mirai)", "value": "690487cbc35df053f003bbfb498f36d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921951, "uuid": "bfe5a04b-e322-4df8-9097-152e48a41777", "comment": "Malware payload (Mirai)", "value": "7daa8e15447234b870c22b9ae41938a773159855c62845eb5de29eef09fb92e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921951, "uuid": "c40cbab9-f875-4426-acc8-ffdc664272eb", "comment": "Malware payload (Mirai)", "value": "02554d038a831378c4ff4f1eed98ffea78b85547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776921951, "uuid": "8f0739c7-91fc-4907-be66-bfcdba82c2f9", "comment": "Malware payload (Mirai)", "value": "0eb79a0d12d101b375a4f91189f86c37cdc351a06b3f862511726a9eacef2bdefe53af52b8f35503e363879eef1ff0b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921951, "uuid": "8ca28469-8bac-4526-abd0-6df9085a33ba", "value": "T1C4630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921951, "uuid": "d36d9af2-26f7-4d0a-9a10-7dc2eb3f1415", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776921951, "uuid": "4ee0bf06-0ac9-44bc-8538-7cee009fae17", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776921951, "uuid": "ff53c973-ab26-403f-80df-745c0eae5d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776921951, "uuid": "8a493951-26a1-4bb8-85a0-c78e3b130980", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fbe75d-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776928553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928553, "uuid": "5d13876b-f351-4c09-ab23-019a72be90a5", "comment": "Malware payload (Phorpiex)", "value": "b9027ebe45812816c0f0f8348d215125", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928553, "uuid": "9fa7f6f9-b3ba-4f50-9967-3ec12cc25290", "comment": "Malware payload (Phorpiex)", "value": "7db487099c98bf397a86cc8fa6b48e20167cedaaf78a72e1ca5ada914bc1d7e6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928553, "uuid": "d8b7a4a7-e80e-41a1-a9a1-5089000e202c", "comment": "Malware payload (Phorpiex)", "value": "02e04beb6d773fe5b64fe995318ed628e6a48cd3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928553, "uuid": "c615a861-20b5-4a0b-b008-42c554eea163", "comment": "Malware payload (Phorpiex)", "value": "9581829dc3958cf796207d23873950b7976ca196dd84dd24f8631387c0f0a90ada40946a7e47ff14a2a7150d7de2a113", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928553, "uuid": "09d3e66e-adb5-4293-b174-580eac470868", "value": "T12F823A0FB8424226E1E110B09672967BD9BD9C7A738424EBF7D44ADA1B686D1FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928553, "uuid": "c9315d63-4fc0-4b55-aae1-7fa4c6e2756f", "value": "ca5592c42b764400102051895df05794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928553, "uuid": "0bad905c-82ff-4eb7-b263-834952c2edb1", "value": "384:AjPtbmV2uL1EaWw5G0yu9NHuage/zav8U9c:EsVPM0P9Nza0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928553, "uuid": "1be74441-afb6-4f1a-9d05-2447f7608385", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928553, "uuid": "55cbc2a9-633d-46ed-8486-6320c08a506d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928553, "uuid": "566d8a1d-f902-471c-9580-36badb083b35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726e2b11-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928202, "uuid": "657b0c19-df77-4fd3-9b50-a65f9f3431de", "comment": "Malware payload", "value": "471e8658190f5a06b5974d9589bed279", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928202, "uuid": "dd1b6903-7026-4cbc-aab3-aecd98c95704", "comment": "Malware payload", "value": "7df2eda0391602d7371c962fd1ea6556cdb2c5ac2bf018a31cc696492e3f6dee", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928202, "uuid": "71531616-57c5-4e83-8497-7a850a3159e3", "comment": "Malware payload", "value": "2da4d9ec1bcc00c1a125a520dc10b52a8b7062b7", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928202, "uuid": "887f0d28-a544-45f5-9450-064e0367af2a", "comment": "Malware payload", "value": "51c9b1efa84be5e9c21d44f2f847e397a5dce7d24351a41dd876737dcd3242fc7a765d251602f4157a85641a0d09c438", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928202, "uuid": "0525c36c-cb64-4379-bc8c-be62a38555a4", "value": "T10A2723569EB7CEF486784FFC20F42E0DDEFB662501A0954A93F63DAA6342689044F07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928202, "uuid": "0a8c04b8-c3f8-49df-bbef-d13a9abf5116", "value": "49152:DUMgbkUMgb1UMgbLUMgbEUMgbmUMgbMUMgbkUMgbVUMgb5UMgbmUMgbTUMgbHxom:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928202, "uuid": "4a4ef200-28aa-42cd-ab96-d6692129ad8b", "value": 20411444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928202, "uuid": "a42625cf-6433-474b-b846-d81044203cb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928202, "uuid": "247004e3-f47f-4eb5-b961-bc1beec35931", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04acb371-3edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925441, "uuid": "56167997-26d6-4e44-9650-ad1f3ed3f9e0", "comment": "Malware payload", "value": "3e232f6f6a3773b999aa83a576e77e78", "object_relation": "md5", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925441, "uuid": "25afce02-dad9-49cd-ad73-e00205b44f63", "comment": "Malware payload", "value": "7e7d52065bead28137bfa887cfd1b22a49c05d0aea8923080d7866e0ab4c856a", "object_relation": "sha256", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925441, "uuid": "000d8f94-8454-4d2d-b772-107dc577f7c0", "comment": "Malware payload", "value": "3e612304a7ed8f4a5874ab5021e9560397f88aed", "object_relation": "sha1", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925441, "uuid": "15d09923-8089-4c8e-a541-692ca32e9896", "comment": "Malware payload", "value": "72fceaa4564742192868872d685c7e125da8a32d1553740c00ecad7273d29af0b9410bfd5cfe2b0012682bdc83c5d5a0", "object_relation": "sha3-384", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925441, "uuid": "6cbb9810-65d6-48c2-8b00-096cceecf2f3", "value": "T1CB572304FC3C072DDA6525A37C673FCE23FD6A928402BFE55AD534DAEA866085B6350C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925441, "uuid": "0db9914c-43bf-4d78-84f4-3cebaa42dcd1", "value": "49152:eb7bmb1b9bAbhbcbZb9bMbgb+b2b7bfbAbXb0bJbabNbNbOblb+bEbgbEbFbAbwC:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925441, "uuid": "44a259e7-35f1-4b58-99fc-4e132dcd1058", "value": 27852215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925441, "uuid": "d90780d9-e664-4199-b2ac-195d5a7bfaf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925441, "uuid": "077e447f-d5c7-4b69-afba-955c53207d55", "value": "7e7d52065bead28137bfa887cfd1b22a49c05d0aea8923080d7866e0ab4c856a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16932088-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776927618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927618, "uuid": "4a6ea78a-57f5-455f-9389-1fbba241beb1", "comment": "Malware payload (AsyncRAT)", "value": "2530098f25b6057249d3a6e7a808093c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927618, "uuid": "39a92758-8a85-4f3b-9338-1757b62d1d25", "comment": "Malware payload (AsyncRAT)", "value": "7ecd3c1f3b4db2d5002c330506df3acb6f54d3cb570b4b02697ed601d7f50185", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927618, "uuid": "836ae7e9-78fd-4e10-afff-2ef36778d6b1", "comment": "Malware payload (AsyncRAT)", "value": "687ad2f979367afc25f4c989039e18a27859d007", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927618, "uuid": "f0bf46a7-dd70-4fdf-b9e9-73add619e675", "comment": "Malware payload (AsyncRAT)", "value": "ac26789944cc32138181569afa0af1fe184506c1687b8dbb10ee1627cd3e7860c098ef55b7d21447d1d56943d0a25eec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927618, "uuid": "4fb09fa3-2288-4c77-aefe-4d3f6c2312e4", "value": "T1120512B52B19EB41E4B24BF61931D27003B21E9DF110C39EEED9DCEB7818BA05925793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927618, "uuid": "76227d08-33a4-4855-9910-a9b9890ecb71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927618, "uuid": "e9b13823-8d72-4d43-9e88-9518b7ec1009", "value": "24576:8Dq4uhtBABmIHxmNG20v/7aX5oMxnihJa3dw:/TSBmI8M22/7aJoEiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927618, "uuid": "622979a6-0503-4c81-8264-7f44e0159010", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927618, "uuid": "2099fe43-59ff-4bae-a834-e57e7636dd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927618, "uuid": "20bd7e96-3cdb-4c1b-9a48-b4f5cebb7377", "value": "z1CompanyNameChange.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58022cb-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927885, "uuid": "ff5fd981-bb94-479b-a103-1f24856db397", "comment": "Malware payload", "value": "d3621f281dd00616564ee6b13b93a615", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927885, "uuid": "2c733b79-b0ed-4dec-888e-dc92a1a1c723", "comment": "Malware payload", "value": "7f3d375c3400ac966d58fc752abccf7d7af4c18a2f6117c834ec1c7eafa379e4", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927885, "uuid": "cf129454-f40a-407a-9b1b-396125224f38", "comment": "Malware payload", "value": "39d97c0bb0ca47b37c67c7000b3794441adec57c", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927885, "uuid": "eec00295-dfc7-4651-a18a-20a86b973709", "comment": "Malware payload", "value": "e2571a41353ab9c0d9d00428c678f8a35a97b082315718d48b1fc4cbbd6e6f281a06e480b720893dfc1441fff5f4564d", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927885, "uuid": "93c27084-607e-4eb6-9f3c-d96ec454c637", "value": "T1D027232D4FAE4D6956A7347C2A590E0F7DDEE895C5601A9B4BDC7CFF2C8D208700B268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927885, "uuid": "d7b66205-665e-4f04-913f-afeb1b20d85d", "value": "49152:4EhykNP+vYcR0KCeOZSJKjCpkxxOPkNXl+gJKlKnUdDK2MY8a/uV393MDIGUG4t1:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927885, "uuid": "42120f04-505f-4129-99c4-cde63a0fbeb9", "value": 21611495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927885, "uuid": "f3a97a05-9cb8-49c0-afa8-e44a5d07371a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927885, "uuid": "6442884e-e987-4df3-a824-63db9bd2689d", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff93721a-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925432, "uuid": "f5ee881f-29ab-4386-9405-6d9853a64cc7", "comment": "Malware payload", "value": "1e4d6cc698b6a801cb78cbd769af438c", "object_relation": "md5", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925432, "uuid": "6cebdea2-b484-4b5b-ba47-b84b171b757d", "comment": "Malware payload", "value": "8033d4222a28a2b243d07ba4795dbf489dcbcc7f06bfa56e3153f51dd046a441", "object_relation": "sha256", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925432, "uuid": "d656f521-c98f-4d51-896d-8bba00307682", "comment": "Malware payload", "value": "f56d6c824b0501e432eabf1b45d18e4140b37ad4", "object_relation": "sha1", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925432, "uuid": "76446db1-9fad-4b0f-85c0-96a6060c8f74", "comment": "Malware payload", "value": "664c0f8d5da5f1b99d39f5b778b472616c7ddc09fea9a19fcebb178f6dda2551291892d3fac5b1c6e7f587cc4b0b662f", "object_relation": "sha3-384", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925432, "uuid": "1cdfa194-61f4-4f8e-93e7-b2d703018797", "value": "T1195723469DBB5E2EEADC30484817450D6CB1474AA2F8EEF525C3E9F9AE0C3167C5307A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925432, "uuid": "c9376488-9639-4d10-9324-62d73e6e8766", "value": "49152:ouBuUuluruCucu3uVuquIuvupuHuquwusuRu4u3uOulu5uJuLuFuauhucuUu1u/k:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925432, "uuid": "7805358c-28b1-4da4-a2af-6408d77bcc7d", "value": 27852301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925432, "uuid": "64f3ac34-e2a4-4762-ad0a-48d73d8012c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925432, "uuid": "5d7bb30d-e9f9-4fa1-825a-707ead0bff4b", "value": "8033d4222a28a2b243d07ba4795dbf489dcbcc7f06bfa56e3153f51dd046a441.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f002cf-3ebc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776911290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776911290, "uuid": "1fd536a6-d197-4f2b-9023-ee216bf409a0", "comment": "Malware payload", "value": "da86876a180c98bde9151bb97bd82492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776911290, "uuid": "f6bb4679-0305-4e79-86c1-62c219bef75a", "comment": "Malware payload", "value": "8057846b383074f436e035011f2b47ce14f4bdbf9b3d8146bdd3bfa47863ad0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776911290, "uuid": "adf67e5f-7035-4c10-b6be-a990c5099f33", "comment": "Malware payload", "value": "c5bec0cb69878d2883067ec3760bfa0a4e8ebc37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776911290, "uuid": "af501f5f-0ad2-4ada-bc22-85379eff47c6", "comment": "Malware payload", "value": "5d54b51aa8bab36b51516f32e013394f9bc324c8b3edab2921ac76c42eefbc81949195b1afe239aec3274b848325b8f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776911290, "uuid": "ba033573-ec9f-4234-b7aa-e28c7552beb5", "value": "T13CB48D46F6A501F9E5A7C138CA578E06E771780603609BEF07E0C6762F237E15A3E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776911290, "uuid": "b84adcf3-32d2-4a73-b03e-b7a4f6ea73eb", "value": "3dbbbe939e8f40df90b93bec415d526e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776911290, "uuid": "26531185-006b-4a30-88ef-46af0a695428", "value": "12288:THdrmjEmLdiYPWMo4A23cTu0BA+ehXpW:rdrOdxPWsoTu0+9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776911290, "uuid": "e3b876ff-8756-486f-be88-eb0f23a18ef3", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776911290, "uuid": "15d63fed-5594-44ef-8276-5ea684084e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776911290, "uuid": "feed8ec4-3cfb-4593-a44a-d6dbbf1c6f9e", "value": "102214433.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb51e11-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934418, "uuid": "1b6da874-39e2-4110-9180-36f60c1b2fa6", "comment": "Malware payload", "value": "2cc48b01d2b619a380de9d2253425979", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934418, "uuid": "e47c0212-4b69-42df-8661-0b86825488f5", "comment": "Malware payload", "value": "80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934418, "uuid": "2a7ec36c-ce97-481a-a26d-4192cfeb3384", "comment": "Malware payload", "value": "b5ef17ade981092376b1815d94ecdaddb8718420", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934418, "uuid": "bb4e76c1-914a-423c-a43d-91546852a0c1", "comment": "Malware payload", "value": "175ab7528229b88a6bcaf152fab7e75e2eff7377b3a18e4d2e4af1919e7667aca19684e4b52b2adc94c65f1535b74236", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934418, "uuid": "564acefe-3e8f-444d-83c4-3b5a36d2bf1c", "value": "T1E4C08055781BD6C4397FB1DEE1D198D1481709031540D9527BCBDC955C4575D93123CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934418, "uuid": "9e21f179-0528-4776-b22c-2e97a4253264", "value": "3:k+xZHPtp5/FERMQ+OX+/otxAgWSJJHJFEiTyWNcGKIF7OJAJCKWqL3dAKCANIsn:kIhtWXqIflEiTF9K4iqrCZ0Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934418, "uuid": "09d20888-a3c7-434a-9649-138c3f54c5cf", "value": 180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934418, "uuid": "c046f4ae-1036-46eb-9179-912aa6bbc077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934418, "uuid": "98b5c598-f253-4aa0-b4e2-d8ebfd55a6fc", "value": "80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cbfca6-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776944263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944263, "uuid": "351aab79-fb21-48a4-b698-71757832f882", "comment": "Malware payload (Gafgyt)", "value": "479feb8fba4aa6a2c999a767b6c31451", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944263, "uuid": "0770849a-665e-4afc-baa5-8d61070f9b98", "comment": "Malware payload (Gafgyt)", "value": "81da269aff4745ba4e326dd488e4dc4b1031a47cc12c5af3bf2e6164489480ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944263, "uuid": "76dd3435-9d22-40b7-b3d8-2bb5f4dd154c", "comment": "Malware payload (Gafgyt)", "value": "c0fd34b9aaa1d782563889e5f475f7ceffb4cb03", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944263, "uuid": "e08cf607-e201-47a7-acb4-9759a2fb09c4", "comment": "Malware payload (Gafgyt)", "value": "6e4ccd9c526d4c5577bb29b9a84dd563ca96a8101d4cf511096f1491fec59a42b09f361a20e837b27627c463d3be0476", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944263, "uuid": "50e41896-fc4d-4063-b111-b361e290f8a0", "value": "T1183150C621E198757DF5F52732A88510B8C5A1C752CFAF49AEEC38D484CDD08B415B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944263, "uuid": "3cfc5ec1-3045-4e15-99be-9c51c805dbf0", "value": "48:YpgpGhpgpIpbspM53pG/kypMpC3pspShpQ3pj:YKshCC9sC0fWCWCu3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944263, "uuid": "4bbd49c4-e7d4-4a1d-8665-8916dae9e64c", "value": 1727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944263, "uuid": "027650df-5f62-4cc8-87c3-8914d878f8c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944263, "uuid": "ebd2b553-3335-415f-90b6-24292b86bb3f", "value": "ur0a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9ef2e4-3eb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776910046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910046, "uuid": "12dff074-ff7f-4642-9846-06628bdf0bda", "comment": "Malware payload", "value": "95267bdaef5c91708ee495af88a5b395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910046, "uuid": "7310dcb4-2e27-4e83-ad67-50217583d372", "comment": "Malware payload", "value": "827954fcfe9efbda35968d9f5928b12d75f9e5c8ea0026df19296ccc4623b170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910046, "uuid": "d8214eca-a6d5-4f51-b60e-e0b31f53c27c", "comment": "Malware payload", "value": "cc31c02ee881ea5927984f9e7f2ceebe2d47b571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910046, "uuid": "890f33b8-5b2a-4856-a660-5aac10f9f94c", "comment": "Malware payload", "value": "80ccf13c2a739db0f09321fa123764b719362744c555534b1541a17d8efea23c4e703233faa120c2b7982cdbdcebd63c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910046, "uuid": "d89251fd-6fc7-4074-84ac-53c94b133794", "value": "T1E1C1A58797D84366E06603317CB313522778E8115F7BA79F25F4137A6EBA79048437B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910046, "uuid": "b30a9297-3b5f-4b0b-849d-b415bde4b40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910046, "uuid": "07fe0180-4620-4f69-b118-2f9642dcb140", "value": "96:xdew7V9rSbZRg8zZgyTy12D8BynqgHlNxiEq7upBK6izNt:xvv2tzuyTyaoyqgHjRq7rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776910046, "uuid": "2d8bd02b-4ba4-4103-a7a3-ef7ddbbf5f35", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776910046, "uuid": "0dcd4f8b-bb7d-4b6c-a368-e9fbc4551048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910046, "uuid": "b768555a-613e-4659-904e-0f93b80e0a78", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd693430-3f3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776967009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967009, "uuid": "233dfb5b-e8fb-4c9b-b5f4-ad6959b0e8e0", "comment": "Malware payload", "value": "2e917bf72973a78345a7c280ee6e4941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967009, "uuid": "eacd9a9c-66f6-4474-a159-21b2a49ad307", "comment": "Malware payload", "value": "82b2b4bc4c84ee240e4a99f7cf16561beeacd0363d9566b1cd985bf365adc306", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967009, "uuid": "26c3cb13-6095-431e-b1a7-fb63757fb69f", "comment": "Malware payload", "value": "32792ea68e074d79d18cf65fe355c9e6c1a8afe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967009, "uuid": "52d93d03-7f3a-4842-89fa-5c2b712b749a", "comment": "Malware payload", "value": "3abb75758cf507846433052c370a1b58deadac56d37bd62c2cb7dabbe6cede6b0b104e8540496c49c230c003530853a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967009, "uuid": "b211fc43-badf-42b6-a8b1-ea13c118afea", "value": "T1EA53F212571B46F9C57E71F273761A05EF70620671059AAF090C27AFF9E78420E25FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967009, "uuid": "9897e976-2394-4fd7-a688-116f28bf4c13", "value": "1536:U72syTYk7bCgiz+00qZ2o1w3DPURnFujR:U723sg8fZxK4FujR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967009, "uuid": "15b1c934-24c7-4d1b-bdd7-bf9c8c9abf68", "value": 60736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967009, "uuid": "a2e8bc49-717c-4dd7-b303-f1c06dc37925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967009, "uuid": "175c4a1a-45c1-4b6b-bd80-9f4e0882b44f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83e555e-3f42-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776969175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969175, "uuid": "1997bf5a-97fa-474e-b1f6-1c7e21690149", "comment": "Malware payload", "value": "1c5194148698be5a90be685cba70f2ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969175, "uuid": "4ff0f137-a9b3-454f-9d1d-470a030d8a0e", "comment": "Malware payload", "value": "832772b0e5f33cdf854675641f7bf705817665c3b803a81f94a63aff8690b222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969175, "uuid": "207538f3-3800-438f-956f-d06a09e4dbc3", "comment": "Malware payload", "value": "b942be3515c990dc27dd902fe2617259f92cfdb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969175, "uuid": "f82ef303-e27f-498e-9232-8458babef26d", "comment": "Malware payload", "value": "298fd29a9421f113dd3a5c0d3e6b55bdd541fd01309cf1b7f9999566353f9531b2f3bb80a6f85d487372fb401b424774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969175, "uuid": "351811a1-c12d-4460-bcea-e6303ceb88f1", "value": "T1C953025DA4A060D1C14EE87FA1EB9374858A24C57C497FD8C7A5CC3C8BB5B872C8F994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969175, "uuid": "c924da6d-58b7-42f2-8679-716c821f8e48", "value": "1536:yoma8TGtKCTbJZH82We/Vk0LRR9LrR9FEcqdbih2JzlhQM:/maFtJzH88hLRDnRObih2RlaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776969175, "uuid": "4e0d6bd6-c8fb-48c8-8e3d-afa4347c0991", "value": 62728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776969175, "uuid": "ab567676-8146-44f9-afe9-50ce725b3ccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969175, "uuid": "2a2c8a7e-f96f-420f-9cee-7f13d7fc4794", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6a37c7-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927927, "uuid": "5e491bcc-2dd2-4514-b82e-6800425cbdc9", "comment": "Malware payload", "value": "af78e3dff9f57aac05c75792435871cb", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927927, "uuid": "baa9ea24-97ff-415d-b069-46c54d2a6369", "comment": "Malware payload", "value": "843c08f2f64e93a4b448de31d6beba259cf8035565e1486e3b7f05cdab24b48c", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927927, "uuid": "b6918487-f458-48cc-845e-c386df0746bc", "comment": "Malware payload", "value": "03d3e55ef766bdecd0dafe8a70805b7470ad65d5", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927927, "uuid": "3586e84b-fadb-401a-b07d-de0bb26668fa", "comment": "Malware payload", "value": "b28c8d8132c14abdd171b2e3ce967eda256315193d9119ea5764bd508612554b2f07c50de40310923b321d075c6d1b7c", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927927, "uuid": "6e25141f-2650-4658-b485-b6ad51f5ada2", "value": "T10B27222C6E6CCF6FDC2C93CC10878F9E8CD5878461429DD29BE5A618378F6069A47B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927927, "uuid": "efba5e92-0f0e-4824-99a4-b78740f0d1cf", "value": "49152:yJQbJQyJQxJQuJQ4JQCJQIJQcJQLJQeJQSJQ/y2iJQlJQPJQ8JQxJQZy2hJQjJQO:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927927, "uuid": "3837deca-fc98-46ec-af8b-b2818c33af9d", "value": 22091541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927927, "uuid": "9a0ab63e-9d3f-44d2-b9b2-9e9f1f84598e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927927, "uuid": "c846b416-9961-495c-99fb-7a32a29e5a3b", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72838570-3f6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776986614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986614, "uuid": "a97bb5c5-14a8-48c1-a3c1-99a8bed4a5c0", "comment": "Malware payload", "value": "335ce7477326d4ac3192f47c4187d3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986614, "uuid": "5b75db34-6e31-4406-9d0d-ac366f53852a", "comment": "Malware payload", "value": "84b36735602ce8c1cb6339c93f932236c869baa0dd16691953d4bd8d9145f06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986614, "uuid": "b2389e91-d133-4070-87a0-2dab364b60b3", "comment": "Malware payload", "value": "56aac5b9788aaad88a6190430ab09f9914e909c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986614, "uuid": "fc198f4f-0294-4c17-a350-939e9d47a171", "comment": "Malware payload", "value": "1f35486f896ebc35f5b4352d0900c9257f1e433951e9260e3369ad39efd8d958e07d73669d4f5985da6c96e7c62571b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986614, "uuid": "7d27059e-c0d9-43c4-aaf0-435de6aae00e", "value": "T1147308879A629FB7C016E0F064F55DB50B16BC621E1F09D9B439FAE4423F8CAB00A774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986614, "uuid": "0560bac1-c3d7-4cde-8769-b161218bf6d6", "value": "1536:SrkKufqaBESVOmXONKSbEzMvJwq1yQHCRCvkPYlWTCXo7/o5:SrZCLX3SL4QHn/Xo7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776986614, "uuid": "b62f4cf9-476c-4862-9b41-f93c9792ec43", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776986614, "uuid": "e5596c67-73a2-4611-ad2d-2d3cd18a8e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986614, "uuid": "37aa094f-cf1a-429d-8a3f-999fecf51502", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda6b135-3f26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776957158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957158, "uuid": "09462ed7-ce9f-4a06-9a8e-1e49f21827f3", "comment": "Malware payload", "value": "258330437452004f32fcffd6ad7ca9f2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957158, "uuid": "ef5be706-42d4-4d43-b7e6-945c90698b4f", "comment": "Malware payload", "value": "85b7b6c02fb7bf8c6446f702640949c66bc8d7c98057b83ee04e542dfe9a56d6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957158, "uuid": "e5e99776-bab5-4789-8a63-4ae0e166743e", "comment": "Malware payload", "value": "bc68c5a02789190fe010827c8244c6216efdf440", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776957158, "uuid": "6269f322-3c7b-452f-bdf0-5193398aca5b", "comment": "Malware payload", "value": "7925712dd1310b5eb9cec701978318c7a23429d07bda9d778b5678cc58bd51a9d360063870c677aa07030c9693bc05c3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957158, "uuid": "140caa80-ac01-4f37-842c-ce111eef4dba", "value": "T1D1E2184237CA4E47E616C6337DE19169FA23AC7158B1636A34CDB75DD7BB180888232F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957158, "uuid": "06ac8fa5-fee3-488c-a1f5-b736af66b071", "value": "384:tpzCSjxk2v8UsvaInEkKv4e1topNkXa66666666666666666hVhqJy69lf6luGU/:XpcU9IENge1CpNkpIAmHb9Yt9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776957158, "uuid": "64bbfd77-f73d-4a02-b7b7-aec8ed16608c", "value": 33973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776957158, "uuid": "d10175de-9f2d-413b-acff-effc47c35088", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776957158, "uuid": "0f642037-02ca-4d12-92e3-695e8a07bed8", "value": "85b7b6c02fb7bf8c6446f702640949c66bc8d7c98057b83ee04e542dfe9a56d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89391896-3ec9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776917073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917073, "uuid": "ec13a676-1f17-43d0-8dd8-e1d1063d81b9", "comment": "Malware payload", "value": "372c0b8c94dea6e483b8ae8a7a616fcc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917073, "uuid": "bc98492a-41ec-432e-b19c-812aa6dd37b3", "comment": "Malware payload", "value": "85e7d670d99776e94f383d9d7c5349f822492583d623ea34b7f18adca0010032", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917073, "uuid": "369f64f8-9634-429c-818b-bcc61bea9872", "comment": "Malware payload", "value": "aa01704e25a7754b408024914c1d3cd0c65df0b3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917073, "uuid": "f6a4e9f2-8980-4b3a-936b-a7b3ad6b3ee8", "comment": "Malware payload", "value": "0f54bdef66f0fa4814aa72dac44e4cd22a773e68bc0b2826f9d2d28cbb2716091481ef06bae66defccd784fc3fab66fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917073, "uuid": "6d6aebbe-d838-4113-ae1c-b239670f611b", "value": "T1EB137D6966857C25AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C096DCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917073, "uuid": "9870f7e9-6048-42f0-9be4-cb1c5665c4a9", "value": "768:bE+d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bE++cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776917073, "uuid": "1a853c5b-70b9-4aff-b869-e6b39748f1bd", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776917073, "uuid": "49de74df-6314-4976-97e0-acd696b01417", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917073, "uuid": "26eb3d3f-b57b-4318-a04e-1e2ecb6b2d7b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328827c7-3f36-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776963743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963743, "uuid": "74ae32ee-18e6-4372-a538-9eebc8642a5d", "comment": "Malware payload (Amadey)", "value": "7a699970dcb155e3256b74e25298bd04", "object_relation": "md5", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963743, "uuid": "60d0ba14-a617-480d-a578-9d4591ed3fa8", "comment": "Malware payload (Amadey)", "value": "860011de83d6c0c36b733a2493450165377308833a5a963c5aae5894c354e14a", "object_relation": "sha256", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963743, "uuid": "11c4b342-be42-479f-bd1f-98b51249009f", "comment": "Malware payload (Amadey)", "value": "743420e7ca41f544c970905d49a4b738563eeb15", "object_relation": "sha1", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963743, "uuid": "937e6641-8e75-4d3d-95dc-ea63c8538b66", "comment": "Malware payload (Amadey)", "value": "fbb28fb3f782bb0f4cc347a19fb40cfa70f58d59c7299f4fc9a986ce6f0ae1179b0ca7393f7548267a54afc818a74746", "object_relation": "sha3-384", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963743, "uuid": "69feadc4-dca8-4f57-bf19-4a7b68ae8036", "value": "T12F557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963743, "uuid": "9b7fae22-a999-4edf-ab26-d7d48f99bd4d", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963743, "uuid": "1e98d3a9-5c9e-4ff4-b33c-e8ecc7ced36c", "value": "24576:6rR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLReS0OnW:6kHmiyCkhh2Bamituw+UjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963743, "uuid": "a06af116-9743-49df-907c-b64c5a79d180", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963743, "uuid": "d262b6bf-1310-4de0-bede-94f41d417c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963743, "uuid": "37f51f44-0636-4c4b-be8f-47a354d2d570", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06050503-3ee7-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776929738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929738, "uuid": "9d662265-9a38-4b7e-b7e2-71b571eeff3a", "comment": "Malware payload (Koadic)", "value": "b29d019335a00d7a4cbc0cddf31f961f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929738, "uuid": "4c247ac4-6ecc-4d29-a484-67ba3d535763", "comment": "Malware payload (Koadic)", "value": "862e9f6287d828ccd2e2f4de1162e159b95353deadff001e499d4bae7b724690", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929738, "uuid": "017d28e0-d9db-445c-a045-31386d910612", "comment": "Malware payload (Koadic)", "value": "899c7a1e17da7a32fceb1a402d569cc3a0152667", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929738, "uuid": "b43a081a-11d8-4a1a-b8bc-9c47dbc67599", "comment": "Malware payload (Koadic)", "value": "d55c40fb7c1ed5116f85f130ca5cb8d44396e4bf22759bf31f99bff642de056e4209e77d21156f80f312b32ab4245e4f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929738, "uuid": "35daee44-fb4b-46c2-80f0-2b7a14345224", "value": "T183E16D6089820AC7F2E780EE6BA5A3257697ACBF162C91DBC57933545DDE20F7FE0410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929738, "uuid": "516e6ebc-bc67-41c1-b2fd-7cc5c5f2621e", "value": "192:b3NQwW5sEQ40OjSUIEuFkmsMgofQXfaFiSyo:b3NQwW5sEQ40OjSUIEuFkmsMgofQXfaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929738, "uuid": "f98311f6-b29e-47cd-bcaa-34ac1b6078f2", "value": 7223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929738, "uuid": "0c91b9a4-0224-4db3-9aa2-c0b061d780b3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929738, "uuid": "1620a8a3-7028-49f4-8401-43e7a246b6cb", "value": "HSBC_Bank_Payment_Advice09238740008.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29982c0-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776956656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956656, "uuid": "d756d76f-f568-4cef-886f-8cc3a8449502", "comment": "Malware payload (Mirai)", "value": "d8ed2fcf49be06fcf07bc0e513d58b31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956656, "uuid": "2e0eef32-02a0-4190-a159-31b8b28f926e", "comment": "Malware payload (Mirai)", "value": "864651854059e59ef415c418eb11440b4ae579ba6f6259afa0a13305c5bcced2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956656, "uuid": "da3aa07a-3e34-475a-94b9-257a5d25461f", "comment": "Malware payload (Mirai)", "value": "ff1788bff8cd3b44c501f51ec007173bf6870c2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956656, "uuid": "2d05a5ff-db4a-446d-98d0-e9a4f36fcf60", "comment": "Malware payload (Mirai)", "value": "19050f49241a1981642dcbb7fcb96a6235c182d4cf42d4a2a328bf1be5717e0c7662541bfe6ebe1dc6d09053922e6f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956656, "uuid": "6a8e5b43-c815-4305-b6fb-caf29fbce65b", "value": "T12CF3FB71984CE6C7C53321BCA0ED9FBA8E7E72DA2749CD027DD161319AC5EAB3906C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956656, "uuid": "dbe2f419-1fb4-4816-bb0d-e95319665bd2", "value": "1536:b64M4J74RUOPMKjaTnQaK+pK7DKrtwp+Vp+wEi4S1:b6WOP3uTnQK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956656, "uuid": "022a8cbd-1c17-46dc-8ab7-8502ce7066b6", "value": 166064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956656, "uuid": "939d6683-9e8a-4b17-9312-925c4a556a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956656, "uuid": "4e8e9f39-c0c1-4cc9-90d5-83e43161fa52", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7273dccf-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923048, "uuid": "b7ca1ea1-a560-4fe0-87ab-60b8ea51e23a", "comment": "Malware payload (Mirai)", "value": "caadefe79352d1d1fc8438ecd1fcceca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923048, "uuid": "76fc1794-2ab6-4eed-9433-b7e218eb7a1f", "comment": "Malware payload (Mirai)", "value": "8680bfd864a825c60580342c89c44c43fa87d2978c93c594e4f339d1115de5eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923048, "uuid": "96e06144-dc0e-4a29-b94c-d689fc2f45ca", "comment": "Malware payload (Mirai)", "value": "b249eb575306667207e44cf3de74d0625f24f503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923048, "uuid": "0286d1f6-68ea-42b0-8232-53422b623715", "comment": "Malware payload (Mirai)", "value": "71052c718c4c5d92bda13dcedb577175c24e5569a8ff9fd1410e3fb864150365fe868566f383809e8121285bd5fbfe2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923048, "uuid": "404f8706-e785-457f-8e4d-94adb033b606", "value": "T118B2CF3C1B151A98EE1EC0BD839D0B603DB42F659182AD8B7206EDC79F968747453AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923048, "uuid": "13c892ac-6807-42f8-95b2-dbc34b141b90", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiJZPmdtJgGlzDpH7uNj1Jz:YeD8ZSWvZHZbs1row697qohQvg9XitJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923048, "uuid": "f5de2611-ba87-4583-af07-e181250329ad", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923048, "uuid": "386e1183-1bfd-43e8-ad72-24945eddbc94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923048, "uuid": "02059836-3dbb-43f4-b56d-75ecdca5f3a6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96135c3c-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924396, "uuid": "9d3fd51d-f022-42ee-95ac-193237f8fb86", "comment": "Malware payload (Mirai)", "value": "bafe193b32ad71b12964de74d960bc8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924396, "uuid": "bc134156-6e64-46cb-927b-73f26e6f701e", "comment": "Malware payload (Mirai)", "value": "86e681687a7d917f439dd137b1f5b991faa75b6fd4a344b92c3e890165416cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924396, "uuid": "c0708c5d-c73f-4826-94ba-0ac98e39e60c", "comment": "Malware payload (Mirai)", "value": "fd027681e43e7fe8e37a4014bbbe7745b38054bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924396, "uuid": "aac68c65-b8e5-4fd7-b62c-a6adb9c9684b", "comment": "Malware payload (Mirai)", "value": "ba6f8af30e9ef5551ada4e8ad99c13d1c727bef3f98a34dc38a21a55691af6848505bb88de832354b93fe7e5f20920f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924396, "uuid": "18f29fbd-2072-4eb0-8d2a-e5e9d4792534", "value": "T1B9144C47EB818A13C4C61775B69F02453323EB64D3EB73069928BFB43F8679E4E62506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924396, "uuid": "00279d12-044c-4741-9981-c7a8ba30bb13", "value": "6144:cKPdmDgolUba4/2KwDiWppMjonH8sC8mk3/0t3:cKgZUba4/2KwDiWp+oRrmkv0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924396, "uuid": "e8c6f482-638b-453d-bd20-65a54f17ff76", "value": 196817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924396, "uuid": "ef3f7559-0912-4533-b938-103b3e1c4986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924396, "uuid": "5d3a569e-e0d7-48cd-95c8-c2b26ded85c3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca64557-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926635, "uuid": "e0d7761d-9bd7-4f0e-9a68-bb1bf49f3b0c", "comment": "Malware payload (Mirai)", "value": "0789d4ffd9e6c628005c01fc661c8040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926635, "uuid": "9bffeb8d-74de-49ba-9b04-fead822e9e31", "comment": "Malware payload (Mirai)", "value": "87613549dad92a7c794ac7eaf4122ddcee6b8e186ca925b21bffefe9df73c06a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926635, "uuid": "a9dc348e-0bce-4534-8208-708a2ae1e17c", "comment": "Malware payload (Mirai)", "value": "ea9e9ebea7fe2b7525d9e5fcf52ac26d1c4405f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926635, "uuid": "63f1d30c-85d0-4d67-b445-9b5bb3c7584a", "comment": "Malware payload (Mirai)", "value": "98bf6d2a1aaeeac04a3f0ec3758d5de8de3876f3f7a4498ca0e83e94d47a3c87225ea5da5f17905a7fd8651c94973dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926635, "uuid": "5fe518e1-c439-4a41-ac27-f0cf385dbcf0", "value": "T1B9334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926635, "uuid": "f326b450-3264-4028-a1ce-c65e05a0d4c0", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwY:ivW3jdQGqt7Y+Z+zN9cGgI6bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926635, "uuid": "45773a0c-7a37-46b5-8068-7dde471959b0", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926635, "uuid": "1323b46d-f929-48f2-bd51-541fbb4baf9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926635, "uuid": "4bafe02a-bd4a-4573-9261-3a989d5e1009", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aada7f5-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926498, "uuid": "ea4d91ed-4522-4cb2-8145-414733ad63e7", "comment": "Malware payload (Mirai)", "value": "56b6079c310a8d199bced56569d54507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926498, "uuid": "11556e8e-e527-4006-8163-448b984f7d7f", "comment": "Malware payload (Mirai)", "value": "88321b2c21e5b8ae88d0fe114e6331df4633177ba923e91113f66878693a830d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926498, "uuid": "d2745508-86c7-4128-b26b-b5479cf902be", "comment": "Malware payload (Mirai)", "value": "457990e3c629f8632fee43bcbe5934e760cf6690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926498, "uuid": "6eec5fc2-8c5c-47c2-9646-ca31d421c863", "comment": "Malware payload (Mirai)", "value": "51d6c1dedc2b366b0e130f20cca1b2220409341d7e5cc42a87564c84ac889dd7865ba41f943199a43909f858af9748fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926498, "uuid": "710a155c-6f8c-4c4f-bb44-1db9f7dba6ef", "value": "T13AF3C50E6E198F7CF79987344BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926498, "uuid": "d8cf2127-45ba-4112-8ebb-8ee00901f0aa", "value": "3072:gOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwZ:gOATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926498, "uuid": "15ffbf38-88c4-4026-9a97-a3f6ac47056f", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926498, "uuid": "d0bae804-91a8-47fa-9dd9-2a1fc5828e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926498, "uuid": "30750895-0f94-4ed7-9993-af0525783867", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57214dc9-3eae-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776905393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905393, "uuid": "97989f56-7056-468f-a5fb-231b8137f57c", "comment": "Malware payload (MassLogger)", "value": "009f49b06ffb6a11360ab20d7ce57473", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905393, "uuid": "2242dba5-1813-4174-884d-c96a6f9b8b11", "comment": "Malware payload (MassLogger)", "value": "88488520b70af36f83351803aab59debe6b031d34bd95a47276fbc040544c496", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905393, "uuid": "0360a9b3-b333-4efb-aa07-f9ba7171f833", "comment": "Malware payload (MassLogger)", "value": "92517de1f5b38f4ff1952698a40fc612d33ba25b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776905393, "uuid": "9a1b468a-f8b4-489b-a0e5-f920f53e403b", "comment": "Malware payload (MassLogger)", "value": "fa043d86eb24fe0ec52bc0238432e364048e78539fcdc9fc9714b4ca34a11e1b0413989bbb876469b95ff573b8ae4928", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905393, "uuid": "2a19e489-29bf-43d4-87f7-be93edcb8f84", "value": "T169E3E1137CDE5FEDCE7A1E1840BE311A73A0C6CF95167549DA22BC46BBEB405016E8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905393, "uuid": "1ceb6cc1-877a-4977-8973-78a3fa6af287", "value": "3072:s2ge3jiRWNRMDv72115E6U6SjRVEiCL8fYEnGA7ch3aL4e:sdKjiMRMDTunEQS9u7Gn/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776905393, "uuid": "126c66b7-e3b6-4a11-9af4-75f5f040a868", "value": 148935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776905393, "uuid": "dfdbd53a-d540-4770-a3ac-c3a8a450f451", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776905393, "uuid": "1fdc6574-98b6-43ff-b87c-dba1701ee284", "value": "QUOTATION REQUEST-R E KDB.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e90da8-3f38-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776964614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964614, "uuid": "25c9b863-dd23-48e7-b9fe-38e6931beb48", "comment": "Malware payload (RemcosRAT)", "value": "f5146679917a4c1bc42bdda3fea4db26", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964614, "uuid": "6dc21a49-3020-4611-a833-d82dde7c4790", "comment": "Malware payload (RemcosRAT)", "value": "888025a04ff1cf4cda4b30aece9f183247670305729b61f2a2d766a7bf0d7fff", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964614, "uuid": "3cd5f83d-ca86-4be7-9af5-0c5f3151e1e0", "comment": "Malware payload (RemcosRAT)", "value": "a9145c9ef48b4add6e9dc9698e255475d978a667", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964614, "uuid": "80b5a55f-9ed6-402e-958d-21826c3f75f7", "comment": "Malware payload (RemcosRAT)", "value": "6bf8dafd631a24f797af6506bb2814bdd6e926158bb1fa335d1c99c954e77199f8a32a597a5be2f19b5ad95a9bd2240a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964614, "uuid": "2875f8b9-14b4-4843-ba20-d3cdf0317490", "value": "T180D45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964614, "uuid": "4e3f6ca8-9c01-431d-9340-1c7af2805bec", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964614, "uuid": "625fa681-04c7-4c50-a1a4-5ce024174da8", "value": "12288:DSGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5hdr:+GuNF0MV/VSU5+1yhHaaPX6P/trZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964614, "uuid": "298ebcb7-bb07-47f2-8f24-080b754377da", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964614, "uuid": "94a60f53-ce4c-497e-96fe-8b184a581f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964614, "uuid": "d50e92be-cd9f-4b55-b275-a06c8bc448b7", "value": "TelegramFIXfull.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5cc8fd-3eec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776932295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932295, "uuid": "3455dcbd-2e1d-4474-a217-8ed8a429f5bf", "comment": "Malware payload", "value": "8d3e790f1de8bb6c21f4ac0c583ebab1", "object_relation": "md5", "Tag": [ { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932295, "uuid": "15e0d76b-9fac-4ebd-82b4-35888964f1ff", "comment": "Malware payload", "value": "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19", "object_relation": "sha256", "Tag": [ { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932295, "uuid": "d56122eb-d430-48a2-85ff-e600622ce4f2", "comment": "Malware payload", "value": "01854c32f006e25206e91eb5a67716c199b38363", "object_relation": "sha1", "Tag": [ { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776932295, "uuid": "22f32075-0d7b-412d-a142-6a10cfac9f60", "comment": "Malware payload", "value": "d622da1d97c08dec81a8ad500706e8427a44018f648713b3e128eb41533972671e3b1108c03990cee2570f0fdf292bdb", "object_relation": "sha3-384", "Tag": [ { "name": "godlike-visit-online", "colour": "#2609D8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932295, "uuid": "88687ea8-899e-4b6e-80e9-39752b411e52", "value": "T1EE52F90FBF0AAF3C854B21E9D66908446EBD2635B651DC34FD4C4075140ACABB2F9AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932295, "uuid": "88cfd825-551b-4d4a-a9c2-c6654f96e47a", "value": "384:9TUa4wUXcXuRtW17BsfSefINwBICboUN3pqgB1ssxPzl:OGuRt0CN3pqgB1/tzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776932295, "uuid": "f74bde16-792e-4147-b209-a1a5f60df132", "value": 13208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776932295, "uuid": "cb0393eb-468b-4dc2-8ef7-1a1e9d1cfb39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776932295, "uuid": "1e94e625-a80e-4e48-96b5-e8135c08bf50", "value": "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f27487-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935192, "uuid": "d20b7c9b-4d2e-437c-85de-3a4abd793d81", "comment": "Malware payload", "value": "d60817143c167a57c17593091ee446eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935192, "uuid": "cb7eb3fe-4e71-4a88-8f0a-e2be70c307c2", "comment": "Malware payload", "value": "89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935192, "uuid": "f952845e-8ec1-4701-9870-6021675d5730", "comment": "Malware payload", "value": "6fb16aa53e1f6b25168e98bce93771b8038681b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935192, "uuid": "e78bb198-45f2-4181-9670-db59c8c152e1", "comment": "Malware payload", "value": "a60a5668aeb7b87007fb74a2168449c6c13c9816c8196b25010ca1d934164095abc97a6c5391dc6f9d2ac751e111561f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935192, "uuid": "d2df94e8-3653-42ca-be24-60e8bb6a1422", "value": "T1EB52ED30D88DDD6DCF2AE4FEC1B6905052B661E297B0D8633F9A074FA125B8275501EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935192, "uuid": "371a3c98-89ab-4145-8f18-cd4ab9e58cc2", "value": "192:2n9xeXy6jFr66E2XZcFql4SlnFaulElWFw:SxAyCJVZeqV3jaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935192, "uuid": "4528b6f4-d717-4345-b15f-1f28e31199b8", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935192, "uuid": "725ac475-ef39-4da1-8207-d572368a4d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935192, "uuid": "721c98c9-2061-491f-a5aa-998379c4f271", "value": "89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77d7e8c-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776927861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927861, "uuid": "52459ebd-6b8c-4dbb-93a3-88242ac230d5", "comment": "Malware payload (AsyncRAT)", "value": "eff53b44cc6059f451a882d929881eb8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927861, "uuid": "3b2f15c6-15a7-4e13-931b-dabaedb64396", "comment": "Malware payload (AsyncRAT)", "value": "8a249e7566f513e34498a82593b400fe5d279ee7687cc52b4a8a709b88d77313", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927861, "uuid": "2e81b154-944c-4f8d-bdc0-092ff58e8bb0", "comment": "Malware payload (AsyncRAT)", "value": "bb7946b057d58be6daa41068f3140cfc41e4551a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927861, "uuid": "d7928553-45c8-4a20-adf2-c75d5331642d", "comment": "Malware payload (AsyncRAT)", "value": "3f1e5678b0b9bd55c31aea100e17ad528cbff0ca53347460b29071dfe52ef878674b451915f06293160dfbae2cab2b22", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927861, "uuid": "cb3cce76-6c3c-4f19-b8b5-fdb674c2eb89", "value": "T1E1E413E51B09E952DCA617F61972F33213A69E1EB011C39BCAEFECEF78153B15019281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927861, "uuid": "fca0588c-88fe-4bee-a2a5-18f8addf452e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927861, "uuid": "277a4347-b727-4102-a784-1828a2aba81c", "value": "12288:79SlMPynthh+Yce84Aun8pfL2mgTBCzDUX58SZpJ1l8RgNeU0IsBE0:JGh0YceZAhKmg8gpxZzj8NIsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927861, "uuid": "3494ebb9-52c9-459d-9616-7f53a77bb166", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927861, "uuid": "65a0e2de-dd24-4dbb-8124-c9e60eb679af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927861, "uuid": "d2ae28b1-7cb0-4b92-88d7-2d1d62e40871", "value": "ASIA AIR FCL VGM Form..........................................................................................................................................................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6354519f-3f30-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776961248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961248, "uuid": "e5655d5a-5496-4b0a-98b9-38081287d773", "comment": "Malware payload (ValleyRAT)", "value": "1ec1e5146216176ddcb7ee4713c4f158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961248, "uuid": "a917df5e-a9cf-446b-9e7b-c79cd4913fac", "comment": "Malware payload (ValleyRAT)", "value": "8a49ed040d2ab50af63ed7d1421661c1ecd0bc0fca9501347b210939ce7478ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961248, "uuid": "8ad2a1fe-3428-495f-851c-c1063d306a09", "comment": "Malware payload (ValleyRAT)", "value": "a37de9ef8c2249935a65ad98e86fbe584e0d852b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776961248, "uuid": "1fe5d93d-0c24-42c2-b484-52f3475172af", "comment": "Malware payload (ValleyRAT)", "value": "828180bdeabb773f1bb2a04de60709ae1f1d4bcb97f52b67406133dd16ba51490a87d85c1e75af1dab84cafffd1beb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961248, "uuid": "7bcf5df5-2986-4f0a-8fef-d8be21dc1ad4", "value": "T12BF50115FA9298F9D42BC071814A877796317C4A072299FF57E40A207F2FBA16F3B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961248, "uuid": "6ae410e4-958d-4985-bccb-ccf45e69ef9a", "value": "c11806e05b3c5dce5951480c5eaf9984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961248, "uuid": "ea2c74ca-f12c-4c80-be28-39e1a8682882", "value": "98304:QPMSRdxTI/6E6IyCa2lhwdnsc+xTI/6E6IyCa2lhwBt2r:mbTIyE6I11hwdnsbTIyE6I11hw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776961248, "uuid": "ffe6deea-117d-4530-8887-45997b1c941a", "value": 3440640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776961248, "uuid": "60ca8571-da06-4173-bc8d-add0ecb7d3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776961248, "uuid": "e9682181-858f-40e3-874b-017eb92c48dc", "value": "\u3010\u3010\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305\u3011\u3011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef9b8ea-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985749, "uuid": "248bd191-58fb-4b72-96cd-5a2df85f420d", "comment": "Malware payload", "value": "0a91dc76808709460020384aefd31b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985749, "uuid": "0204339f-5dbc-4e3c-9a9f-fd994bc275e6", "comment": "Malware payload", "value": "8a4bd165631a4e287510f4cb7e145e1be65365c39e3b8ce575ce2e0ff7e413a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985749, "uuid": "f2f6f93f-9cbc-4716-a3b4-0eed89b5eda9", "comment": "Malware payload", "value": "5507c52ee4c6a023ba8b89eb4aff14090e743928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985749, "uuid": "22b81916-5aef-4026-b58c-46ac45254ec1", "comment": "Malware payload", "value": "bb2889204c0a18b735417136336eb9048f6e42558da85ae5a39139987278cda5b7de800abb604e0bb2b7937f9efaa59b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985749, "uuid": "26f2e961-c356-42dc-8dd6-18a8e6be7f35", "value": "T19093D697FD00EF77F40BA77A44A30815B230BFA60E921AB2B217399BD9361D41427F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985749, "uuid": "19641be0-fbde-4493-a416-2b3664bd646e", "value": "1536:5hi1CpeO1I9yN5O8F6vXQ3+ySgmdNoptEHcx9a3n8Fae4YJABgqP:WgtO9yN5kX0+ySgmdAE8xUO3AuqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985749, "uuid": "f5f5448d-d481-470e-8622-77dea6a6195b", "value": 95596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985749, "uuid": "f4708093-6966-4636-ad3c-ecfdb2db3d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985749, "uuid": "39208ac3-c697-4ea8-9096-e7ec346a9f72", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4feb3b-3f2c-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776959577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959577, "uuid": "8ebfda9d-1686-4bd1-bcbf-c8d6856e5345", "comment": "Malware payload (ValleyRAT)", "value": "a518f80149e9cc140706f534a8e10d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959577, "uuid": "ea47298b-df41-4e14-973f-3f4d2e938748", "comment": "Malware payload (ValleyRAT)", "value": "8a8175e91acfc45ba91795f6012d41bb21254f3880e061e2b90384626e452941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959577, "uuid": "896eeded-156a-4730-b209-d53a04baf77d", "comment": "Malware payload (ValleyRAT)", "value": "a1764f6d076c27d5c734b3af45792ee5a28b0d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959577, "uuid": "c4656414-bb90-4e23-873a-1a76ebb1f43b", "comment": "Malware payload (ValleyRAT)", "value": "45a5d0ae48dd72e57092cf320388a5c2231577707b6fab89478b80b83573fc85b105835b67e9eb60ea18d18a826e00fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959577, "uuid": "51c3f803-9a78-4719-904f-76d10dfd9b19", "value": "T17AB56A0290E7B24DFF69E17548EBD2E0C2A7BCA07A3024DE9847742956731B3BB25D1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959577, "uuid": "c1d23386-fe45-41f7-a6b7-812cf79ae1f6", "value": "463587305391a2ea56c1d343803363ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959577, "uuid": "72342bda-50b4-44b2-a304-6f6cebae8c36", "value": "24576:6TGnUpQAtlJIGfia6oY3hJQDDtwgymIWr1UkSSSuSSSMSSSSSSSSSSSSSSSo:6TDtlJIGfy/YxMmIQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776959577, "uuid": "c931c0d9-6973-4c2d-83e0-709abde90a5b", "value": 2453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776959577, "uuid": "00149c7e-4186-499d-84eb-378b1272bc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959577, "uuid": "3fc06d68-4784-4f4b-9f13-ca9e0fd713aa", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00oR15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126065d6-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928041, "uuid": "eb8a43ce-1a29-448e-ac2f-22ae798e6c5f", "comment": "Malware payload", "value": "3da2cee0910bd2b9adf3afd2d0d2c097", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928041, "uuid": "aede9d6f-d399-4702-8658-5da997d247af", "comment": "Malware payload", "value": "8aa3b587edc6311125a246d63b61919b6c926e39fc66fcb45a4ccc4cdea92434", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928041, "uuid": "60a60fa3-53c5-4cb5-9958-324cac0282f8", "comment": "Malware payload", "value": "aa7b46d364177f2b85f703b1deb3021e14a0f0c6", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928041, "uuid": "226eb163-8403-450d-9a8e-f8094c7971b2", "comment": "Malware payload", "value": "e03ecb1abcd406c7b68ccffdba0e2a89fa59523002e699a2451248b4dccca2558143740caa5779cdf744bde2b4a338d8", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928041, "uuid": "0f05da38-5edf-46a9-8f99-46156a103eee", "value": "T13F3723474FD76E0F8554F23628B74D2D1B500CAA4145E6EE4A633ED28AE3EA6B04F31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928041, "uuid": "98a241c9-1245-4ad6-b9e9-f9c4d5233bdc", "value": "49152:wd19d1Sd11d10d1Kd1Ud1bd1od1fd1Fd1ad1/CXEd1Ad1ad1Td1Md1fCXtd1ud13:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928041, "uuid": "cc134f30-0d53-492c-93d3-b0bae37c6b36", "value": 23051589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928041, "uuid": "7d0a347b-dbbf-4891-b5e9-901f791d14d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928041, "uuid": "df381670-945f-48ae-8370-6f0e454a9373", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c2942-3f26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956922, "uuid": "e1ecbc15-6a7e-4914-a168-0ba66b51f68f", "comment": "Malware payload", "value": "dee50a94594990dbbe6911b22c0b0b02", "object_relation": "md5", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956922, "uuid": "69652402-832d-4d44-bc27-fd5cd0cf09c1", "comment": "Malware payload", "value": "8ae28e5be53fba4d88b1b9a632c53aa82cec5f9474aab1aff8c438cf5df413c8", "object_relation": "sha256", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956922, "uuid": "f383da69-2ff4-4612-bd0f-60c4743dca8b", "comment": "Malware payload", "value": "08a14fd3331ba50be7ff8f08f58ddc14247bd32d", "object_relation": "sha1", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956922, "uuid": "119e4701-666b-4530-adec-4080434bbe96", "comment": "Malware payload", "value": "a898d9ef34c45159bf4c2c58354101ebcb4113e36eedb8d1d0a51d5c5ee445935aff2fb2a010842ef91f34b41b04c621", "object_relation": "sha3-384", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956922, "uuid": "0330208e-13f6-4ed0-a95b-b0fcc4cdd332", "value": "T14C341A227055D031D65262F21965AFF297DDAD304FF288EB67C06F7BCA202C17925E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956922, "uuid": "399493f9-19d1-49b6-9b2b-7655e7d1bbe3", "value": "0687f4267a8a639386af9c923f9cf3a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956922, "uuid": "9000ebef-0ca1-4e8f-bc17-23e84412275d", "value": "3072:Fdp1Q1isY2QisPLj/UWv5KYEy0AMmr8TqK9O2tCRlSrYdj1YK8oPaIByjzg937Jm:LWe5LD5j0AMm4WK9rMRM0deiaQLBr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956922, "uuid": "7ff452df-b76a-4eba-9d4e-a4336e799cbe", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956922, "uuid": "d45dd5d4-d7cb-4bad-9428-4fe961412781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956922, "uuid": "91a9f5fd-f32d-4c86-a044-c14190e52e2c", "value": "8ae28e5be53fba4d88b1b9a632c53aa82cec5f9474aab1aff8c438cf5df413c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4beb89-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985580, "uuid": "ad76f2ca-919d-48e8-94fd-3ca8cdff5f4e", "comment": "Malware payload", "value": "1ef594b3aef471993f5dc88be710e980", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985580, "uuid": "919fca6a-c1ed-4517-9abc-4ecb1e5166b4", "comment": "Malware payload", "value": "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985580, "uuid": "3438b03b-027d-4d44-8354-8c816087c69c", "comment": "Malware payload", "value": "a39ba6a303bf9c4572ba7805da130f8154b4c623", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985580, "uuid": "a74532a9-253d-47cc-9580-c469e6b28c11", "comment": "Malware payload", "value": "7a20792a5bdc9b94f625f1e0aba37c9e27ba65d272bb0491eae24686589bd0322704d780fbb9dc407027cd045b9c7e4a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985580, "uuid": "2a0cb8b9-dfd5-4d85-9d2f-5cfde26b3c9a", "value": "T19AF312CF5A21494933D9EE53D54643097E6307E118BC5928EFA1DA38381FF3F064E6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985580, "uuid": "2e37d994-c78f-4436-82bb-b457c2896464", "value": "3072:w0lYT8Y6qq22jDrlCQ3NYAqpL0iA7kNODveXuWBlHxPrJuk/RSssTszXZ6u9JPkf:h1qq2WPYcqAqpQ3tD6uWBlHxPre+puaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985580, "uuid": "80e008c8-52f1-4a20-b093-614183909695", "value": 170557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985580, "uuid": "d3c5f278-7e98-4fb1-b601-0137464347f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985580, "uuid": "88a5ddcb-0885-46df-84cf-3e524a75626f", "value": "lady.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7682794a-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963427, "uuid": "c924e4c9-8b9e-4f59-9234-f4c593e69d5e", "comment": "Malware payload (Mirai)", "value": "5012a5252a69cd0c6235284285cc4d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963427, "uuid": "2f8b22e2-7ff1-43be-a553-2e5c86eba870", "comment": "Malware payload (Mirai)", "value": "8bbf7f1415d21d66d15700adfbd66a4bde7032c916b5a2bce2c497d8f04d2df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963427, "uuid": "a05e0ac6-bd4a-412e-99cd-189ae5806745", "comment": "Malware payload (Mirai)", "value": "1a1dc29438e063e9225bf850a84ba892f167d809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963427, "uuid": "521c718f-bb3d-4ca9-b29c-22c98529e25e", "comment": "Malware payload (Mirai)", "value": "929c8546e0bae38247523422d2351b4876d5e56cfe7753d95b1693b28c92c581e810b65abc4845bb591b4ad4d9239ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963427, "uuid": "702bc548-537b-40e2-815a-b64932c8523e", "value": "T1C0532890BC819A13C6D012B7FB5E428D332767A8D2DE7313AD266F11778B91F0E67642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963427, "uuid": "5e7706c2-feb7-4e66-9d69-cd53e32d1d79", "value": "768:izv8bekhpK7h23tbClhceioot90OmKOVCoS/NRjrrb1qHMkAgr6OuNXn8V3OEv9c:081hpK927eitv7XD7kl6VX8tOEv9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963427, "uuid": "3eaa8d84-f4d4-4fb4-a1ae-2158e4fead8e", "value": 63924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963427, "uuid": "a48e4c14-53a3-4149-9466-4b7a2bef4786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963427, "uuid": "17942d6d-2cc9-435b-b50e-62e33a731b22", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a714757-3f21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954764, "uuid": "1f7d43d6-d073-4b59-a6f3-93f3f44433fc", "comment": "Malware payload", "value": "407a55b3575a95e3d8b4cb1365ea6aa3", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954764, "uuid": "38d1a9b2-b5b7-4cd7-96f7-eabee6abbae6", "comment": "Malware payload", "value": "8c145e95ed84ea15417eb150b76969c81fa74e0d98a94a6699ebe96100f575e6", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954764, "uuid": "c8a874d3-8a7e-4065-bc27-65d42fcaa804", "comment": "Malware payload", "value": "ac230a0e5b5a8bd34d428b1cda2d1daad165780a", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954764, "uuid": "1347642f-c9fc-4ce6-90af-63984f4430c9", "comment": "Malware payload", "value": "d37954f351e37c2d970c92db03cdb3439c01e42970404d621044c6f85bbb09f8722b838545be63ead4577fc9169b74c1", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954764, "uuid": "63fd98e4-5d9d-4758-b814-525dd7260df7", "value": "T1E0F2F274D519751EB2158DC820A35EBE7FBA4F87A48DDD7C163C107F2A08AE16314E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954764, "uuid": "f9e93822-7dcd-4ba6-b4a7-d11f3b4d689d", "value": "768:MSArYyfxPcUKUy+MUH/pS7/S6TBqQbkQPQ00K/TsvGJglZJ:9KqUvpAJcQYQCKQ+gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954764, "uuid": "8910bfc5-2836-4bec-acb7-24a82d3564ac", "value": 35696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954764, "uuid": "6b19f3b0-6c1f-4d76-942e-8dafba403c24", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954764, "uuid": "2c4d4ec5-910d-4e80-9196-40813d534389", "value": "nELHO_W_E4rmetech.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d9cfb-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928234, "uuid": "5a682371-3b19-48fd-a29c-c7fdde7ce09a", "comment": "Malware payload", "value": "a1ba2199d991db22c76c061ea4482e4a", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928234, "uuid": "54ec44eb-fd8d-4c49-b3c9-2d9a7120f73f", "comment": "Malware payload", "value": "8c8fbaca0ef617e31bb5d75d0169c28a5e23e5f73fc3108e498c3a2ef25760de", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928234, "uuid": "a8b13f2f-c710-45d1-a1cf-73346a3f437d", "comment": "Malware payload", "value": "e9cc2cddd7cbf76ea64f77665ffcdcb6cd3d2f79", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928234, "uuid": "1ec0ad34-4d90-433b-b134-a12a25c6a5bd", "comment": "Malware payload", "value": "d72e6daa1233dede6d5479d657a292a20a521c8b53ce965a3b29e61f37b984c0234d92d6cc5c7fe56a30a576c7a95daa", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928234, "uuid": "d96fa2ed-94cb-468f-aed0-9373726253e1", "value": "T198272371CE5C4B7E42FC022C28BB5F9F55B04E806429F8E1F9A5DDB6D60AC192C5227E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928234, "uuid": "097e549e-b2c9-4bb4-af84-b0e8eccbc69d", "value": "49152:pECcECRECpEC7ECCECYEC9ECmECvEC7ECwEC+hswEC6ECBECBEC2ECWhs1ECXECA:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928234, "uuid": "464afe02-4afe-4524-bda7-ce5437617739", "value": 21611517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928234, "uuid": "11d95f6b-b84e-4db9-96b6-67318dfef3b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928234, "uuid": "91c74de0-14c6-460a-b554-480395424495", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a95f94-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload (NGate)", "timestamp": 1776955500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955500, "uuid": "d37e269d-952f-4d72-a35c-9ed5430d8035", "comment": "Malware payload (NGate)", "value": "29809efa7370aa8679d3c60b9a8c7d49", "object_relation": "md5", "Tag": [ { "name": "108-165-230-223", "colour": "#627C43", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "NGate-NFC", "colour": "#DF751B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955500, "uuid": "8ec090a0-40b6-4576-a761-e504da0e9c1e", "comment": "Malware payload (NGate)", "value": "8c93845d33f36a96a72deb5d0a07a9be93589461dd3bce8c87293d82d18459af", "object_relation": "sha256", "Tag": [ { "name": "108-165-230-223", "colour": "#627C43", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "NGate-NFC", "colour": "#DF751B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955500, "uuid": "273ce430-04c3-4633-ad12-056a8c628d6f", "comment": "Malware payload (NGate)", "value": "a4f793539480677241ef312150e9c02e324c0aa2", "object_relation": "sha1", "Tag": [ { "name": "108-165-230-223", "colour": "#627C43", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "NGate-NFC", "colour": "#DF751B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955500, "uuid": "a7693e4d-271b-4628-8b79-a2e2359b458b", "comment": "Malware payload (NGate)", "value": "29bb00391c808ec5450050ba9e0a800194fae6b53aea0cb152ede8bb66357b5b3f436d0f6532b9e6611a04ae2c53f0de", "object_relation": "sha3-384", "Tag": [ { "name": "108-165-230-223", "colour": "#627C43", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "NGate-NFC", "colour": "#DF751B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955500, "uuid": "dff73e85-348f-4303-b257-0df31933c3ca", "value": "T194D5AC57F748D9AAC8F783B245759362111B8C298B83E6C36D14337C18B7AD42F4AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955500, "uuid": "96247d33-53dd-484d-9302-36939588d7d1", "value": "49152:C9uBQLYXThy8XtnZ3r3hh5/6In+tlSbXlQM9dS629dS6OcFJp4jSM+IEz:CUqu5tZrhX/1nHbXHqafSM+IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955500, "uuid": "c4db65d5-082e-4519-836d-ddb1f9f7bf1f", "value": 2945352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955500, "uuid": "b957c5a3-e391-458f-9036-1628fd2397c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955500, "uuid": "26289e5b-592f-4bbe-bd8b-0d95f9b4d1cc", "value": "8c93845d33f36a96a72deb5d0a07a9be93589461dd3bce8c87293d82d18459af.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87662f33-3f06-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776943269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943269, "uuid": "edfde84b-80b2-4edb-8abb-2ba02df990f1", "comment": "Malware payload (Smoke Loader)", "value": "4d40d9c6445cb096f24bbca6862042a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943269, "uuid": "bb9d900b-1996-4611-83a0-13bbd7551ce8", "comment": "Malware payload (Smoke Loader)", "value": "8dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943269, "uuid": "09584b1d-0556-4d94-b00c-a567f5a859bd", "comment": "Malware payload (Smoke Loader)", "value": "6d4242a4819ea8a58ea362056f4034d408da01f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943269, "uuid": "00a89290-acc4-43b5-89da-cf2f8a9b989b", "comment": "Malware payload (Smoke Loader)", "value": "721dfc44b5574d823711ce67b201712ed12bede82eaeb781e4db92cfaeca259333bbc84ce284f1625c6aaa93507f1016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943269, "uuid": "36313bc7-fcbf-43a4-91f0-bfdc33f147e0", "value": "T136B56C05799104BEC45977314CF63682B739F8080B2A67D32E57AB782EB3BD05C7639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943269, "uuid": "00502d89-09c5-43a5-8397-cdab81509c72", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943269, "uuid": "d3b2633c-a7bd-43e9-b59f-226ebcc1f892", "value": "49152:vlIHziPTUFYBWCS1PQqElvkZAYbIbUgJRAldxsTp:vjuJbsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776943269, "uuid": "7e55e7b5-cf0f-4ed0-b260-8bcee313d152", "value": 2394120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776943269, "uuid": "f3d44180-8cad-4917-85b1-9b1a781cf169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943269, "uuid": "f90aa3ed-7780-4651-a974-84471830e34e", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3bd164-3eec-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776931896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931896, "uuid": "ccd5d282-fa7a-46f8-8065-73d3b41ac123", "comment": "Malware payload (PhantomStealer)", "value": "256cc4f1b574803a56bd86d1c0105155", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931896, "uuid": "2d5fd37e-c76a-4b00-aa4d-dcd3249fcc85", "comment": "Malware payload (PhantomStealer)", "value": "8de51ae7bf455ca3aa5e63c3cd20821034c9ae02330f4a6a41fde1be5f6437ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931896, "uuid": "19f70985-eb02-49bd-adc8-1bb0945406a5", "comment": "Malware payload (PhantomStealer)", "value": "9b7a19e7b1bbaa769a767c24eece3fab8a2e7519", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931896, "uuid": "065f0449-9025-44c3-976b-eb42c857074f", "comment": "Malware payload (PhantomStealer)", "value": "fb7bb5a9b8b1318467b404eab7ed9541c1ac464e49373cb495fb27d090d6b3ec9f463aec335fe8f2fd7596a93797222b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931896, "uuid": "b9ceab82-50e5-4539-b1bd-53d07eeaee16", "value": "T11C541B203AFE5019B1B3EF55AFF47596996FBA633A0AE45D1050038E0733E41DEE163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931896, "uuid": "b1f463b0-6976-414f-b8a0-1e8465f72721", "value": "6144:Jy66Gw2QH8Y1DITIqDtLFU/DDjifSST1HCOB8noX:JSGwR8Y9IT5tLG/DDj4SSTtCOBG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931896, "uuid": "d471d72a-2dcc-4d30-b934-599278c8563f", "value": 296034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931896, "uuid": "7a9c2acc-ccc5-4e26-9bed-e81915349c9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931896, "uuid": "75da6a28-b6f7-4454-b570-59c317b597dc", "value": "SHIPPING DOCUMENTS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5191afef-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972385, "uuid": "45355f7a-ed11-4b9c-84c4-ada68f58ef7c", "comment": "Malware payload (Mirai)", "value": "85b64c855d0c74e13f5058b90e907a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972385, "uuid": "c721a7bb-59d6-4535-ac89-f2666de47372", "comment": "Malware payload (Mirai)", "value": "8f51b5248323cb05faba550c4d350eeef30babe9d322e4ad127783efd4a13906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972385, "uuid": "2309b8f1-d365-41e4-9bfd-579c3896feab", "comment": "Malware payload (Mirai)", "value": "7149ee196f96deb82f000dbcc28916422e3c6d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972385, "uuid": "a2863e4b-5d9b-415e-a780-4bf0a4a0650d", "comment": "Malware payload (Mirai)", "value": "12f5b833290bb1c2c2ea6ad298a95d6139e99d3f69e4f348707bdd496eb1cc315f282c93dfbd9439f9170c003091aa15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972385, "uuid": "1f200df4-4259-439f-8cb8-894ef9bf36a6", "value": "T1C1040956B8C19B11C5D152BEFE1E428E33231B78E2DE7202AD216B24778B87B0F3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972385, "uuid": "9eb6c04a-358e-4714-b24e-010dbdaa11d5", "value": "3072:xmXn/HxT88pga8wX2kBn/azwpVejqWHGSuPCtiqQbg:4/H3pgEXxB/aMXnWHG3AiqQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972385, "uuid": "50967890-14b7-4f27-b5d3-e7d8d67f3a26", "value": 174748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972385, "uuid": "7c94dac0-8fba-44ec-94f7-e6de34d4253f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972385, "uuid": "1e8bc17b-0377-41d7-a2d8-6d4185851d97", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f47e07-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776925015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925015, "uuid": "a3a70a6f-7e70-40b3-a747-9138ab42b870", "comment": "Malware payload (AgentTesla)", "value": "7a71edb304bd05c9340cbd303cd82291", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925015, "uuid": "06ea59fa-12ee-438a-8074-5bb00f592415", "comment": "Malware payload (AgentTesla)", "value": "9079dcbdc9ef5c34052eb9e8c1d2f80be47c3f1dffa4414f83e9b911ca30a6c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925015, "uuid": "ed889c7b-0262-4665-a626-08ca145ec2ba", "comment": "Malware payload (AgentTesla)", "value": "dc8213a67f3cf8532546daad6afb1b01cd7657be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925015, "uuid": "b7d4a915-987e-4255-925c-375dc74c23de", "comment": "Malware payload (AgentTesla)", "value": "6a28a197c89403f8a438387103dd7451caff339e0e77d38f0c09eb06df9cc28ff9b4492f022e1c57a279a8c6e52904c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925015, "uuid": "be2e166f-05c9-4069-9301-3279d3279609", "value": "T1F0F155254B8E36BBBC573C86B25D4514EE46503E17EAE4B6A00C2D2B1FD2DDF8F22095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925015, "uuid": "26249f3e-0b57-4d9f-b0ec-4301909d60b9", "value": "96:OMlalPhMbWAlOl8qtCAgeayCoYhpE52Vq2ayCBcP56:zEl2pgdtCAa8D52o2a+P56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925015, "uuid": "33f0d1be-6cec-49da-8f6f-4058e1559b00", "value": 7998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925015, "uuid": "76caae28-baf1-4eed-89ff-254afd760970", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925015, "uuid": "de4ae1f7-cbd6-47ed-b519-4fe7e1a5677a", "value": "Vessel_Main_Information+Baltic_Questionaire.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c65098e-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776931601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931601, "uuid": "2d33b203-fa2e-4465-805d-6feddd056d50", "comment": "Malware payload (AgentTesla)", "value": "11523bebe3c852361cc16ab77ba38d0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931601, "uuid": "42dc048c-0c3b-404d-85c9-4d417d10dab5", "comment": "Malware payload (AgentTesla)", "value": "90ba7e6419ee0dfa5632ce332f35cbc5d45784cda58e8fa4315d96b0c4c363d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931601, "uuid": "480c9c46-924a-4223-9200-36da0e28eac1", "comment": "Malware payload (AgentTesla)", "value": "9138bf48b05e1fa29adc3e7646ebf736db0175b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931601, "uuid": "f11e8d0d-5dbc-445c-8da5-7aa4d427796a", "comment": "Malware payload (AgentTesla)", "value": "525d4c63e132bcc35d05ec963df076dc78abcf77d62732c5f41c4e8f2e3cd87f0bee77e5d44e6b38ad5ee060ebf1c2de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931601, "uuid": "b831f91a-fdc9-4c0b-860b-98de4cb55b14", "value": "T1276230AA4D8B797677440B9551B9C493E442B8AE98FF709EF0187014E6F2D0BE385CF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931601, "uuid": "c1bad10b-c5df-4333-a1b4-920dc4c77708", "value": "192:c/QBnu6gj52Vs3QfYax/ay3l4ZH9Es+NANOfqWDBSKEj/mXu2PUnMN:c/QBnu6Ul3QfpZkH9Z7gD5XNUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931601, "uuid": "ea6cedda-58af-40a2-896a-1e9ba7f1b15e", "value": 15016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931601, "uuid": "3347fac6-d7b3-4677-b5df-12e1285057f4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931601, "uuid": "56569e2f-9eb5-4941-9db3-00fb502da4fe", "value": "RFQ_P.Order0096556786.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff9bf9c-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924359, "uuid": "7e14867c-470e-4f9d-88bd-aaa01fc1097f", "comment": "Malware payload (Mirai)", "value": "706c25210d5136db0e50f2a5ebbbdc01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924359, "uuid": "2b6f1843-5d17-4f0b-821c-6ee2d37aa128", "comment": "Malware payload (Mirai)", "value": "91d0add02f99417319e40069337fbbd13b75982b9a33554bf06e39f85719517f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924359, "uuid": "7428176b-2e7a-42d0-8944-c1ea3aa01117", "comment": "Malware payload (Mirai)", "value": "d4eda1eb5321787ad973d4df049ca40cf12dc844", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924359, "uuid": "2e55448d-cbdb-494c-a31f-9743a849c959", "comment": "Malware payload (Mirai)", "value": "26765e00e5fa6654f069d46c94a63e70add1a8d34c2aa11b8558cb8de696cd645e7f8eacadef059c1202850c8b8c9064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924359, "uuid": "c02329c0-9fd9-4575-9a2d-c461004e9c1c", "value": "T157739D63D8397D64E15406B4B0B48E344B73E59085572FFAA56AC379E08BEECF1093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924359, "uuid": "25cf9a75-aa49-48e5-8274-bfc7713b1afb", "value": "1536:ZaI/M/DDeEHxVNhkRWoNdO5aKLJ9sL1E8PXCZD+Z:ZZUXtqRPO59L+1hPXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924359, "uuid": "2fedcf5f-2500-4355-a98b-c0f5d717d9b3", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924359, "uuid": "9d58f54f-2037-4fc0-94e1-f92d0e08aea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924359, "uuid": "ff157825-7977-4fde-b80a-e701d05ca52b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7dea23-3f03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776942099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776942099, "uuid": "27f9ad7b-27d4-4610-8daf-7ec1d9f163e6", "comment": "Malware payload", "value": "2756a328ab26728d666ea5928364f028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776942099, "uuid": "552c0c5c-c21a-430b-9ce9-28aa4d9aee12", "comment": "Malware payload", "value": "920b2686db2424938a68e12b6923df7c9d029a6073a4f53a233645058e60bf39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776942099, "uuid": "24d5ec3b-9f25-480e-a002-50a324997e0d", "comment": "Malware payload", "value": "b35df1dc73e084fab1b8c8629081ccad7dbe5ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776942099, "uuid": "f24fe750-0922-4961-84b4-586b9a9a6558", "comment": "Malware payload", "value": "e9742ddd6169fcb9aec49b197c1c77ade116cd88a6db169659e7408f15aa97f49531f439144ba8555b30af2310c0d570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776942099, "uuid": "bbc4bc54-ec96-44fe-87eb-b55ba23c9a76", "value": "T18628337BE28F207DE13E68767A73A10010376A216866DC4196ECF45DDFA16B11D3F28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776942099, "uuid": "eb18a6c0-ebaf-44af-add1-77ca3373139a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776942099, "uuid": "1e000158-3146-48b2-a86e-facd695f5f2b", "value": "1572864:2kitmXiCvnDQdwABwlC+j6F78F2sX4vt6MlY5tTKWn355tE/T0i3/Aak/ifLM:ncrmkahA974XGXi35PE/T0iDjLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776942099, "uuid": "771a9632-b317-42b6-a668-cc9db92454cb", "value": 97307743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776942099, "uuid": "e8b307ef-8dcd-44da-bc41-b86c5ca14866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776942099, "uuid": "e628b939-470d-4687-b9e4-c08e9028b782", "value": "script_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5bd158-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938315, "uuid": "56c5d4d0-bb61-44a7-b5b2-91b9c280c32a", "comment": "Malware payload", "value": "63a1e163092fe2f4612eb2ea147ea006", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938315, "uuid": "c994154b-7e36-4c05-ae94-d6302ffb6d23", "comment": "Malware payload", "value": "9224d6c868bde2fc921b33a17d2027fd29aa38c2560007cadc137961df405624", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938315, "uuid": "604f584b-db01-4816-bdaf-439a6e7c8f89", "comment": "Malware payload", "value": "789ec7ce632082831fd4df103ba67434ca1c56dd", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938315, "uuid": "5a0f8e71-b979-4d08-bb0d-e2e5a71e8a7d", "comment": "Malware payload", "value": "37f9b835112fe14c0a5ee3d425c867eb4eb3977c8bb925a1b61dfdae8d3ed3da76e1b34ead3d18102953c485fc06a5ae", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938315, "uuid": "b8426912-8888-4293-88de-321e513e4257", "value": "T130276C57D89940E9C6D9C531C575A223BF71BC88873127DB6BA0FB246FB2BC0667A700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938315, "uuid": "696f0d62-4ac0-41ae-ae2c-f6053d60619f", "value": "196608:MJw1/grm/ckq8HoHfBSbBuCRIDjHdwiLy+ShdxSt4KW:Sm/grDksfM5R8j9vIdEt4KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938315, "uuid": "630f711c-627d-478c-9b23-18af039abf09", "value": 21562693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938315, "uuid": "73db24f7-30d7-4d19-a1ca-28bc714b2d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938315, "uuid": "a3be50e4-0c96-468a-8faa-5c0edeb1d033", "value": "9224d6c868bde2fc921b33a17d2027fd29aa38c2560007cadc137961df405624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478bf964-3ef5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776935861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935861, "uuid": "59a8a4bb-12d2-4526-a11f-81584164e1b3", "comment": "Malware payload (ValleyRAT)", "value": "08162d4bf8f74cdddd453e3c6c5c10c7", "object_relation": "md5", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935861, "uuid": "6b18560f-f206-4c3b-afb6-fbceeb0be76a", "comment": "Malware payload (ValleyRAT)", "value": "925d6b3001eb4ae91bd066f7229e17979c86f6be137ecd84feb199d670ce0beb", "object_relation": "sha256", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935861, "uuid": "22ca5ad1-8f43-41a8-87a9-d0423d015d92", "comment": "Malware payload (ValleyRAT)", "value": "f793197f7bee7f2786e2e5e0c3954952109129af", "object_relation": "sha1", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935861, "uuid": "b1e6d5bc-fbb1-4bac-ba66-44b5c1d19c6d", "comment": "Malware payload (ValleyRAT)", "value": "450abf9b408aa98cd2e5d5d8cb9db5060fd05193f510c5610d4611251557e7e48ac0072b2ed925958be6c4280b849116", "object_relation": "sha3-384", "Tag": [ { "name": "151-242-152-131", "colour": "#934F79", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935861, "uuid": "02053ce0-177a-425e-9d94-19c245ab834c", "value": "T1FF146B227780C17AC19B153195BB9F721EBDB932076881CFB3949E790FA03D1BA7470A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935861, "uuid": "678b16c8-fb9c-44a2-ae0c-acf6f6f00e8b", "value": "ee113de6a7e41d580c082b16b3603fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935861, "uuid": "4829582f-107e-4034-8614-446cc75e2dd7", "value": "6144:JMBBwDbYhqu/pxHyYubw4gRaGQ9u0Qj8fUz:SDwDbY8iKbw4gRaGQU0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935861, "uuid": "8d2351f7-1375-42b5-b326-cd602c0dffd1", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935861, "uuid": "e4b036d9-95e8-4107-ad01-60a85c9bff75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935861, "uuid": "1a29359f-2ef7-4543-9da6-8b46e8eff82f", "value": "925d6b3001eb4ae91bd066f7229e17979c86f6be137ecd84feb199d670ce0beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9154e2d-3f2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776959271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959271, "uuid": "e9392aa8-18b2-4c07-b361-2fd4b9f00eae", "comment": "Malware payload", "value": "3f92799760d5d4610b8dc587ca71d41f", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959271, "uuid": "18176d75-152a-4fe3-b33a-2fe57ff01c4f", "comment": "Malware payload", "value": "93766d20b45496fdcfd7a4fd8ae74888a76c5bec2658078890ced4c237fd062a", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959271, "uuid": "1cdfa7f1-ad9d-4785-b5c3-588ba2555e8c", "comment": "Malware payload", "value": "13f6ec0c4c273af0c6a79d8671e2a2882fb84547", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959271, "uuid": "443be6d8-e4bb-49eb-baaf-4fc491d0dd99", "comment": "Malware payload", "value": "ca313057917e6d25aa7032200c7b483de25c4763e73fca5dccf8a37bfb27473bd0d8472b421de5aa33edc3441be0e4f6", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959271, "uuid": "6b5ae7a4-7c5c-490b-936f-5eb5f35bbd8c", "value": "T1AB37F14AF61CD42BDDE9B0BCCD8F07A3B52679151610C28B3822860DFDA37D49B65BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959271, "uuid": "eb70ebbe-36e1-4299-8de6-c5eb6ddc346e", "value": "393216:CWNSYRdjA2migyMjUg3begrQxCuKrW701QCFn:CWNvDrtWzZcFv4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776959271, "uuid": "f95ca647-3157-4a07-8a96-a8a47da7f251", "value": 23777694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776959271, "uuid": "12bba51d-2f8e-40eb-a263-a5e0ab21776f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959271, "uuid": "4ac05aab-4340-4041-a508-b339e676b8ec", "value": "Cool+SMS+Messenger_1.2.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdc0b08-3ec9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776917079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917079, "uuid": "c13530bd-e374-4f9d-9a1b-2b74340466e4", "comment": "Malware payload (Mirai)", "value": "1b1ec24e38bbe9de797de500bcc5aaeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917079, "uuid": "3f34df6f-2512-4a2e-856a-3990ddfbd681", "comment": "Malware payload (Mirai)", "value": "9402444c99fccff14a6d2c13cc045002f8a1faab4fff9d4bd61039dd4cf7e1ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917079, "uuid": "1880eb21-6a01-41a5-a9a7-f48be3dc6600", "comment": "Malware payload (Mirai)", "value": "10c3b852e78a7d244a272cc91ebe6bc54a49422c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917079, "uuid": "924b4af5-2479-4816-b7bc-ff7ea9b28732", "comment": "Malware payload (Mirai)", "value": "510ba8973b03a3c791bbc72689a2a60f0b5bb38220302bea1979fa8fd16c65dba2c42acc4c95c3e186eb3803b0bffef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917079, "uuid": "ad8a0911-f40d-4bce-a842-d66f44b13ddd", "value": "T153A2E17DFB20C1CCF082847E2957127B456FF8A64B98420EAE15D0C701C79DEE49AEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917079, "uuid": "978f4e1f-2058-4753-af01-a95d082f238a", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxh+cP:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776917079, "uuid": "94f6fefa-67ff-4af3-995e-27494fab2e95", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776917079, "uuid": "df173a4e-2e1f-49d9-8235-a764ac160992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917079, "uuid": "d7ad20de-b2a1-4101-a203-0c736e7c2e20", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143386f5-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776943935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943935, "uuid": "9ff05afe-537f-40d6-a40e-7bc8a23afbb9", "comment": "Malware payload (MassLogger)", "value": "0239eb54aef99821e4c4f861e7ec6568", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943935, "uuid": "36c7c934-fae2-40e0-825a-e926a8b18a1c", "comment": "Malware payload (MassLogger)", "value": "9417f2925371ccf6a79d8f5b66cae6c6103687118844ebdc8bf365a1724f0765", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943935, "uuid": "f47ec464-627c-41cc-9b53-852d21e022e5", "comment": "Malware payload (MassLogger)", "value": "c65acb1b3d2cd97858860bb6cfbc1548353b775e", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943935, "uuid": "73521b63-d7d5-4323-984b-c9b48c0950a5", "comment": "Malware payload (MassLogger)", "value": "fae9ec4abeb67f7a940fd65997302e885e7299300024c070b5bac105048ffe058d155e2a672e2cbe501fc0e93d17bc1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943935, "uuid": "5406af50-2f56-42e4-a3fc-035d3a5dfd8b", "value": "T1EA7502218DC42FB4CFEC561C90FE161EA7F05A8E4416A98EEB73BD46BFE7540120B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943935, "uuid": "87122b37-6165-4aa7-964b-b53a977d2ed7", "value": "24576:kn45DorN/2vsZy0X9pXznZXSwMJ04VLo1VzUDFb3aj5:AN5/1LUDFz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776943935, "uuid": "e3d8291a-9a3a-4303-bd16-b745cabb9b11", "value": 1593705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776943935, "uuid": "7f1ed1fa-44c5-4948-a9f4-30f25da8ad3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943935, "uuid": "d59b7aa2-ce48-4ccc-8d0b-2f971dd4019c", "value": "MT103-4893-ERROR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f55e19-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "4db7a470-10cd-42d3-a6e7-f5971f89ab65", "comment": "Malware payload (Mirai)", "value": "870d1b7eb1d8c72439c4e6a5c789f1ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "c066ab21-c29c-4657-b030-787d0901dc79", "comment": "Malware payload (Mirai)", "value": "94e92792d59b57c819d3d4645f77a247ed4121c577fa5381fd3097e99ead2266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "d4ec2258-3c34-4575-b491-fce7d7ed6fa2", "comment": "Malware payload (Mirai)", "value": "00a0fa1df391856f4c9bd9df877d7268c28d3d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923099, "uuid": "03672510-0ec9-4047-84c7-5a003a185cf0", "comment": "Malware payload (Mirai)", "value": "c3b467eb081c624b4149a9ffb5e355a7f210967bada254804529f7ca2710eb4a138487ac9d8c5d78729882eb393fe405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "cd9709e5-58aa-4639-a13a-b2bac4a59bcc", "value": "T1F5E23A8679159966C9C0147AF99A525C332307B8E3DF7303BE10972936A3F2B0EBBD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "ceea956a-b55a-47de-b900-0325e52fa531", "value": "768:aAaIzmKrEUH5w+ASRUclFHu9/FLXOH72j0ZubA0:BfhOXSRUIHUZRjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923099, "uuid": "3130ab9c-cb5a-4817-a51f-b06ec72283cd", "value": 33572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923099, "uuid": "a057f412-843f-4bc5-bd6b-2190aa3f4f9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923099, "uuid": "d5f54dd6-7305-49ab-8f15-0fb24472f9fd", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25faf57d-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956420, "uuid": "8cb4c2d3-7a15-4789-9589-8bd7a85ed55b", "comment": "Malware payload", "value": "a0110a3094836efe1ac3c2cb77b7e1c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956420, "uuid": "22134805-b020-4aa3-93a0-cbc68c3e6197", "comment": "Malware payload", "value": "953100ecfa12cc7326082604df69c455bc037f2a9d57182191d28ea0a61162d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956420, "uuid": "9f311587-f205-4f99-97ea-acac4f4ae68b", "comment": "Malware payload", "value": "00e1aff894748198eb10f847674b2a6099b3cc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956420, "uuid": "58d411ff-6b95-4dc7-9c2b-24b2da3a692a", "comment": "Malware payload", "value": "1ad7ba6a36113dafc8e9d9b8ccedb95f4c08c8d052f766a4d79898a1376eee56917503ad8c98ca34ca893dc270b52873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956420, "uuid": "74368054-7ea2-487e-a7bd-43e5c07756cd", "value": "T12304C0C93059C357C7A15C31B43399E376699A611C3F6122F6132BD22EF2E94BB7470A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956420, "uuid": "7ac56ab5-3429-42c0-bd5a-324bd36c85ee", "value": "731ac9c60818e00f408c476feda29178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956420, "uuid": "c6d5daae-9cdb-41c5-ae91-f929ea994936", "value": "3072:VOo1Tbg90dIKmR5j273PAmr0auTmqqfDCn+C5C7Q2mDo:B1XqN5a73Px3uTBqfDCn+C5CMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956420, "uuid": "5e7104c7-8b98-4e86-88d2-2e2e2bf63dc4", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956420, "uuid": "79b2e591-1830-4ff2-bb1a-e4988329e100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956420, "uuid": "7750e9e6-96bb-4a7c-b71b-a0b568ccee39", "value": "953100ecfa12cc7326082604df69c455bc037f2a9d57182191d28ea0a61162d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf3f7ee-3eba-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776910555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910555, "uuid": "0952c92d-1ff6-434d-9de6-4c96c215e029", "comment": "Malware payload (MassLogger)", "value": "4725d3cc859e5ce08ae392596b497485", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910555, "uuid": "de8eafcf-ca11-42cb-8d5e-dab7a553c5ae", "comment": "Malware payload (MassLogger)", "value": "95b620de060eaaedf521423892275b8fe6f635e720c9f294704d1f1df5b46036", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910555, "uuid": "510ce2d2-c375-42d0-ae45-5bdbc68e8569", "comment": "Malware payload (MassLogger)", "value": "d85c25d7d0dc38a7f7ce101b38dd1fb140768404", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910555, "uuid": "2f80b96a-784d-4c67-a29f-33684590a934", "comment": "Malware payload (MassLogger)", "value": "26d39ff1c9fad0929463444de733cca05e33b7fc6f7db28c9056a219dc58f9ddd8f5467a52ac2a5e869acb5b639ad913", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910555, "uuid": "d9c85286-2369-404a-b114-3243122cfd5c", "value": "T107B312245D490BDA69DF0761B157B99A22C2802C4FDF2D85219EC87333EFB4D9984CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910555, "uuid": "805d2058-23ac-4833-89f5-582258f095af", "value": "3072:ah0v1dfO6XWSYNC9oBmIoB6/aqt1Xu1+d:bfO6Z6ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776910555, "uuid": "838475bd-f2f3-4650-9769-2b849f94ad0c", "value": 108676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776910555, "uuid": "21b738e1-c403-4205-a19c-88a1079952df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910555, "uuid": "904640d8-dc5c-48f8-bfb2-24e9a6a546dc", "value": "Earn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a6b441-3f5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776980250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980250, "uuid": "5d7b7e4d-be42-4c3b-a8f0-9a284f000f0f", "comment": "Malware payload", "value": "9ad601a2e12e823d5da740c0626405d1", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980250, "uuid": "1d2be7c8-f8f7-4eb9-b981-a1594d33b809", "comment": "Malware payload", "value": "97a2be4870fd61f01fb36d2c9a314ca27648fd516e113daa8e8ee8e066678a46", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980250, "uuid": "38ae7f91-39cf-44ae-8587-87a111116a39", "comment": "Malware payload", "value": "c7d881c5fd6463882fe13a1ba35f751357176790", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776980250, "uuid": "af42032f-a8a2-4174-99e8-bc6a33c34333", "comment": "Malware payload", "value": "415cecad2864b94f4be64a0a04c85206084c366474739c73dc5d43f0dee395b10158b51e6f500847f0596415840a4cf5", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "caixaentradas1inboxshop-site", "colour": "#D13A1F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980250, "uuid": "382da57d-a3b2-4516-8ea2-27446eba1ba6", "value": "T17507339B2D8700E6E8CD4970971B77DA12F3129A45D7083B7DC13ACAB0E1FB171A6987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980250, "uuid": "0e8b3c41-175e-4ca8-8853-1bd3ba4a83bb", "value": "b509a411c33b5c73b35d9ec43a489595", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980250, "uuid": "bced99b3-34d1-40c9-ab0b-1d517ab08715", "value": "393216:WQOTIx690IejLlCj64kjRm0svWBXW/9mHmJb2z:WQOHAjLlNm0svWZA9mHmJb2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776980250, "uuid": "e9bf4c8b-0281-47df-b032-4762bb075ec2", "value": 17153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776980250, "uuid": "52f5fdcb-f37e-4cec-8fce-16b009e26b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776980250, "uuid": "9c99b039-1c92-4744-8610-5cb4dc6b41b9", "value": "Drivespan01.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36401806-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776924235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924235, "uuid": "48500539-6fe9-43ab-abba-42b42a5ad203", "comment": "Malware payload (AgentTesla)", "value": "81ab233cd50e1b9ffb3b93cad970f081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924235, "uuid": "2349cd64-26f9-4c4a-bb4f-21175d504891", "comment": "Malware payload (AgentTesla)", "value": "9814ac937692de581b6931fc2b5ea54b5fde2609e7000898da56840c86e0f240", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924235, "uuid": "35358391-4d2f-4376-9632-8437b3d12efb", "comment": "Malware payload (AgentTesla)", "value": "15a475e542d623944d57d007e2e29ce7cdefe29c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924235, "uuid": "584add8f-cb9d-4653-9f0d-e461448ec9eb", "comment": "Malware payload (AgentTesla)", "value": "ddafc764b327a36bcb504d4af326c3b348ab8c601dfa5b4a13499152be6cbcd12ae8f436fd3406ff630ea3576f2c7f88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924235, "uuid": "66b9f771-2247-4a34-b0a9-55ba3214335c", "value": "T1E4A53CE47A25D65C318E0A9334088A971CAB7F398F57BBDF52055168C0AE0D6D2F837E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924235, "uuid": "8fbe40ea-2e78-4d10-a24b-740ce90fbd1a", "value": "192:C01AAv9nFjJFjnorvCIOwujsBfsM0UPm4J0AUTyTto0JH2xcJijo2BqE2N7jLXnw:+/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924235, "uuid": "a931eb27-21e4-41e5-bb19-27dd9431937e", "value": 2110908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924235, "uuid": "ccca23eb-d214-44ef-93d9-b267f53294a7", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924235, "uuid": "4430c8f3-c95b-4535-8981-c893892ec86b", "value": "PO10023789076.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb53179-3f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956648, "uuid": "8009fc5f-9f06-476e-bb5f-b884d14ac5a3", "comment": "Malware payload", "value": "de6ab9eb0f1f49c65443117c0d914e8c", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956648, "uuid": "dda0dfac-a361-4ef0-b491-df31c97178c0", "comment": "Malware payload", "value": "981e2933bec27faa871440846c6c4f1c81ab60f578d52ba4f3fd35ca18761415", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956648, "uuid": "88d2150e-e275-4af8-9e4e-e628c03c6727", "comment": "Malware payload", "value": "34c34625c096e8e34ad1c30c15eab32367c9c16f", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956648, "uuid": "9803916f-90d6-4129-9a3e-cca7d36d778a", "comment": "Malware payload", "value": "7b2ea854aca3183bc358b46f4c2244ef87454a8c3e4fc6ef657893a57efef5091e94ccafb53b90c041db10b3e18c49e0", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8404821567", "colour": "#5408B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956648, "uuid": "3c9ae5ff-a558-4bb0-943c-503e02f26bf6", "value": "T123854D03E2A360FDC12FC13487D59A72F53074684134AEAFA6D1C7362A74ED05B5AB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956648, "uuid": "8d0f6ccb-192d-41bf-a82f-639f66a86888", "value": "8ea2ac051c081c8f14a900919120809a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956648, "uuid": "75b7da17-3f15-4081-8194-eace3b580f1d", "value": "49152:BaUiz887+Ix3gzrVvnc1vYeoIrtgWurD:B8zt7+5CFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956648, "uuid": "27197ee8-02e9-4be7-b6aa-1c42d5a9d750", "value": 1742848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956648, "uuid": "cca44310-f0d0-4760-ad8d-7521cf05bc82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956648, "uuid": "5be90f1d-7882-4e43-bb06-77c74b0bb99a", "value": "981e2933bec27faa871440846c6c4f1c81ab60f578d52ba4f3fd35ca18761415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f7a25a-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924503, "uuid": "63f9977b-ca4d-4538-a185-7137f92efe0f", "comment": "Malware payload", "value": "225424c87a07922d65047d1d2cedfe47", "object_relation": "md5", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924503, "uuid": "44decb77-3612-4a4d-b73c-d290d898198f", "comment": "Malware payload", "value": "99afbb5f18a7b2a3707412939fde9ddc2baffed004ecd6c4ea8777c4fcde183c", "object_relation": "sha256", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924503, "uuid": "2576bc8e-f371-48f1-a158-49b9cba6b427", "comment": "Malware payload", "value": "9bdf9930dd9d1f41d4e6165a473501c014171d14", "object_relation": "sha1", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924503, "uuid": "45aa3586-4f86-471a-98e2-6af35e539d6d", "comment": "Malware payload", "value": "9b5c97f1536fa4672a4126594e2d4e8c01f46006c5ddd3a767748597f4be3516cbd2753d0543eccb371bb4193acdb05d", "object_relation": "sha3-384", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924503, "uuid": "b2677b04-3278-4ad3-9a8e-71c1c07408c2", "value": "T1D8A5CCD9ECD8DD2696946FAC73610023725AFD89F1FA2143F76319E72AAD4C121AC7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924503, "uuid": "70d05c2b-a48f-48db-976c-5dc524cd3cd1", "value": "12288:0W4f7wxgW4f7wxgW4f7wxgW4f7wx8EciTmmaHmumuOttLs94xVw0OuTvFQ1lAMSG:0bXbXbXbxEc9cVwZlAMSvc+xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924503, "uuid": "d6dda479-a8a4-4789-a6bf-ea033a848d64", "value": 2155480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924503, "uuid": "d302a648-fec3-4331-9146-0bec066882b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924503, "uuid": "c5396274-e303-4f7c-b079-f909ebcb5d66", "value": "99afbb5f18a7b2a3707412939fde9ddc2baffed004ecd6c4ea8777c4fcde183c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1401bbe2-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924178, "uuid": "183e08d2-8dc1-449f-99d9-4efe7066dac8", "comment": "Malware payload", "value": "e2882fc749fb29e0fced23c96bc52996", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com ps1", "colour": "#A44F4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924178, "uuid": "fa6883c4-b0df-4d4a-a14b-951654f04685", "comment": "Malware payload", "value": "99c955c07af4b1e16642236cabe2a634b2dedc662e39a147c23e30e706944017", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com ps1", "colour": "#A44F4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924178, "uuid": "621576fc-b411-49d9-8028-25287cb33da3", "comment": "Malware payload", "value": "1589b9fe4246205bd1cb9f5e561674de084628a6", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com ps1", "colour": "#A44F4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924178, "uuid": "aaa2558d-9367-4ef2-82ba-ead57328d7ca", "comment": "Malware payload", "value": "270db6d270a1b902a90d922a468f26bd89e64b1d4931665ae9548b521b21223e4aa25aa98c9020450b16b85981345155", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "himachaly17aplr-blogspot-com ps1", "colour": "#A44F4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924178, "uuid": "89689cf1-f559-4a17-9517-a22ab2f9123a", "value": "T1C7857EE9DB449358F1C03A2DB2360212B3FEB9A9E6F6A383D233673A355E047550535B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924178, "uuid": "9c7a74cb-177e-4042-95bb-aa8a457a985c", "value": "12288:JR6Vw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFzVw0OuTvFmaj0GlAMSvc+n:JEVwAVwAVwAVwAVwAjFlAMSvc+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924178, "uuid": "eccfb1ec-8c91-40f8-ae16-1665af43bae5", "value": 1789882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924178, "uuid": "9fb62689-3b9b-4783-87a2-3a08862b9cce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924178, "uuid": "77c44d95-47b2-4002-89d3-9465a43f7b00", "value": "09c1d5_e294b64717f9404887beb0ddc0ef324e.t.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8b5f27-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944330, "uuid": "4424ddc0-4fee-41b1-a11e-186588b6ce80", "comment": "Malware payload", "value": "32bdbf5c26e691cbbd451545bca52b56", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944330, "uuid": "e2ee1e09-ec02-4eb8-9436-e6c51a3c95c8", "comment": "Malware payload", "value": "99ec6437f74eec19e33c1a0b4ac8826bcc44848f87cd1a1c2b379fae9df62de9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944330, "uuid": "d380d13b-a021-4a3a-9d66-651748c68625", "comment": "Malware payload", "value": "63b27aeda63ea0ddf3db9b685d55ca01d5754357", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944330, "uuid": "e50d4d84-34b8-43f1-8681-03eecb38c745", "comment": "Malware payload", "value": "aa6e9d006e73f0d79844f28535e1f1fe4f65409319c7724fe6bcb546ded2d3c136c7a74ce21ed757f7c2ff105863ef46", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944330, "uuid": "1a2ea472-60cb-40e1-a49d-a80d01509d5e", "value": "T1D451561237FD461CF6F71B39AA7AA65158BAFD09EE22E64D1115604C0C60F20CE72B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944330, "uuid": "51bb58e6-67fa-4c6f-8e59-cbd8779c34c6", "value": "48:8wEfRSnfzeKJ5QC7Cf77NQtwdBkHTJd0DdDabiMH:8wEfR8be7NvoHEDdDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944330, "uuid": "ac581e8f-3521-47c1-adb6-e51aa3404ec7", "value": 2489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944330, "uuid": "260e67c7-e4ac-4e7e-ac4f-821018252a67", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944330, "uuid": "fc5d7928-727b-4e99-bc0a-3048c859789f", "value": "99ec6437f74eec19e33c1a0b4ac8826bcc44848f87cd1a1c2b379fae9df62de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8d004a-3ef0-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776933911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933911, "uuid": "c16a0119-d1c4-4187-aea8-cbd743d25d3b", "comment": "Malware payload (CoinMiner)", "value": "daedb96fb442405827a6f093c36742b1", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933911, "uuid": "ba692ea7-185a-4f3b-afd6-b086b471a830", "comment": "Malware payload (CoinMiner)", "value": "99edc9e963d0bcee4d230737569f7fe91e65e3a41d2ffd2eba162a8cfebd0b0f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933911, "uuid": "7d3f5ba7-9383-4d02-94ae-db9421e875ed", "comment": "Malware payload (CoinMiner)", "value": "225d3c629774bc76fa758af3210124ee479eec7e", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933911, "uuid": "efedf713-f2ec-4305-9fd5-e35a786b49fc", "comment": "Malware payload (CoinMiner)", "value": "67865958e73744f631a7b74b6aa1b55491a97789a1f8b57110eb8713b430fb066387b5db7a0e67732005f6b2ba5c5f3d", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933911, "uuid": "86c567a6-131f-44ed-812c-1a5b75ac1c38", "value": "T147465B217A5A99ACC19AC47483478A725A3570CF0F36B9FF44C492783FA9AF45F3C258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933911, "uuid": "a6921f5d-af37-495d-981f-b1f5a3e9e806", "value": "768ad5ac895dfc8305f5e4fc17e61c6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933911, "uuid": "4b7f1f47-7db9-4bde-b787-05d83b739bd6", "value": "49152:UlqqZSpiMdED9esPo8DKDkyWEgmotmR6YYOqBAsCDbXrUl1qmbkPAdf9BRvPB0En:F+Km+oiKaPvPA59BR3B0Iz+biAZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933911, "uuid": "440d514d-1634-44ca-9e26-a3d7f92ac055", "value": 5581824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933911, "uuid": "19693385-27bd-4fcd-9e7c-f3d43b29ce4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933911, "uuid": "acb809f5-2534-41c0-a05a-b4a58ec997df", "value": "99edc9e963d0bcee4d230737569f7fe91e65e3a41d2ffd2eba162a8cfebd0b0f(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d26bcf2-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927844, "uuid": "e96b3adc-a4d2-4f4b-b49d-568a1fde465d", "comment": "Malware payload", "value": "0f1b9bcc4e55ec606c09d4f1e051e4ed", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927844, "uuid": "797ec690-d768-41e2-a258-5a31daf81d1e", "comment": "Malware payload", "value": "99f19dd7b693e60669d7ed938c068d8e63b1fa678845ec7724476ad97adade6b", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927844, "uuid": "e2a30f0a-78ab-492a-a925-83e58346c7cc", "comment": "Malware payload", "value": "b502ea51e14369a4ce5d35a1382023414897c9db", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927844, "uuid": "bd87ae9f-9886-49ce-9d61-7bd6d97a36af", "comment": "Malware payload", "value": "7ccc430bf15898feee80965fc46a798649c28c36c8d8a2692f49b764ee49f41b63d516db66bcba209ecdc1987e57703b", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927844, "uuid": "fd81e122-c4b0-4ec6-b60e-0d160c4aaed7", "value": "T1D12713574006AE7866711A5D74FF1E0716F09FA0CF2B27F462A6ECDB684FE72221225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927844, "uuid": "6dd749f9-9133-4be7-9921-0419f114867f", "value": "49152:X9J379J3H9J329J3N9J3P9J3d9J3h9J3h9J3g9J3v9J3f9J3ZP9J3w9J3Q9J3J9W:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927844, "uuid": "79e74ced-a33d-46c4-b8a3-22ef91dc33ef", "value": 22331557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927844, "uuid": "8c615ce2-237f-48c9-aa13-7cb899adfb29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927844, "uuid": "63f1af4c-2670-4c69-8361-6ce340b6deba", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfe5598-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926475, "uuid": "13f973e5-e4c3-4f58-8d6d-bf899e8d59cf", "comment": "Malware payload (Mirai)", "value": "f9aed0dcc89bf0602b53b6fec3994d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926475, "uuid": "fb8d35fd-4e7a-4f6a-8954-08b366248270", "comment": "Malware payload (Mirai)", "value": "9ad35547002ed05bcb1a61955b6032eb484531c0316b10b230fe3adb4ef4a932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926475, "uuid": "397f7b9c-3b8d-4ae9-88fe-56aab1f0dc45", "comment": "Malware payload (Mirai)", "value": "931cfd8bf9afe0e360273de1cac132581fb90775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926475, "uuid": "845ed4c0-43fd-49b0-9c2a-dbedb24b0217", "comment": "Malware payload (Mirai)", "value": "19c956a666ce89be1265a4fd64821cbd743992b464cba747d2bd337a04eaa925f06d9ac231337c2c6120053b446717c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926475, "uuid": "39fe7f5d-f46f-4c36-8b2b-beb4e01a0f60", "value": "T11F432921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926475, "uuid": "212d1baf-c2b1-4cc5-a752-537f8b57c8f6", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926475, "uuid": "48da89f6-b938-4016-bfaa-1d7d58b36123", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926475, "uuid": "23a6c9ba-5a1d-4cf6-919c-31dcc36edba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926475, "uuid": "7fdcbc44-7c4f-453a-9da4-eee4c7b8b9d1", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2263258-3ef2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934751, "uuid": "21e30bb5-a7b5-433c-8f43-b2f1ba04a7cf", "comment": "Malware payload", "value": "c42708354261ac78983d305d826fde53", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934751, "uuid": "f29aeb36-33ba-402b-a4e5-bc0e458d27b4", "comment": "Malware payload", "value": "9b2637b8fefeedf8dca8a0ace491de05b6d937ea7463b48562cd1a0f25abb9f5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934751, "uuid": "0fde09f1-b7b2-4848-83bf-f6619960bf1a", "comment": "Malware payload", "value": "acdf6fa6ebcb80beb8039eb849cb473d00f1e56d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934751, "uuid": "69c0c6c9-9458-4994-b642-8863a24603fd", "comment": "Malware payload", "value": "03b98daba8a673ff22c7d3768debcf67dc39130d4f73266216040643f67482b059e87148fa44f85041fe538b794d6759", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934751, "uuid": "d9c5c052-a15d-4d5b-bbc2-2ad1de856ca8", "value": "T10D717B0417F54318F3B74B3EB8BFA2514576BC6CEE318A9D1160D1880CE5629E87AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934751, "uuid": "cd312f47-29a3-468c-b46a-f5d633dc8fdd", "value": "96:8orXgOL+jlcWjlcv2dN2fjlcosXSY1um3YLq:8orXgC+jVjK2dN2fjiSY1jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934751, "uuid": "14a038cf-2fb1-47c8-b18b-12794ecf0428", "value": 3762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934751, "uuid": "f6308aa0-d721-44e8-880f-4ce09a951cd1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934751, "uuid": "92a2014b-e995-4a16-8a0e-48239b5e18fa", "value": "FAKE_CAPTCHA.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e4e609-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968309, "uuid": "891ffd41-7cff-42a6-bf45-c584a40ff527", "comment": "Malware payload", "value": "d1d919209559420ec4af5e14c910a3c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968309, "uuid": "9d9f581b-6ab4-4dde-9a4d-0bbab8076ecf", "comment": "Malware payload", "value": "9bad10b87be2a9b52ea5778036eef5a6fd43527e5140596d0e9b0481fec6b88d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968309, "uuid": "54e50523-6acb-44c9-ba06-10f82ae6470a", "comment": "Malware payload", "value": "8a4d537fb653be5bcba7bab131e097be71262b03", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968309, "uuid": "69b76466-d84d-44e6-98d3-ec810f283c1a", "comment": "Malware payload", "value": "44ddffa6796759d4d3c8e1acfc90985d0b598fb0030639da44dc34b7e3b56680f605426c28cd99601a03f315b9779215", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968309, "uuid": "73260eec-cd7d-4555-b716-c5def3496e2b", "value": "T1D206F186FF59952FC8B700324F6A837532668D128E829B076558372C6CB7ADC0F5DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968309, "uuid": "1c0f39b7-0a96-433b-b424-4fa708ae9cf6", "value": "98304:658BtaJiJYCnoyWdYrCExTSksG2Ybksh8JWr7HMJ3+TEB:65KtaJPCn4WYG2YbH9tEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968309, "uuid": "408ec68b-e356-4556-9c41-4d7c23d380c8", "value": 3999190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968309, "uuid": "2ca2bee9-3557-41df-a503-975c6eff4152", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968309, "uuid": "d8240c8b-3035-42a4-aa3b-457cbb8037c1", "value": "9bad10b87be2a9b52ea5778036eef5a6fd43527e5140596d0e9b0481fec6b88d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d720106-3efc-11f1-a769-42010a9c0008", "comment": "Malware payload (GoGra)", "timestamp": 1776938931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938931, "uuid": "f83ad7d4-c238-4f61-8d08-b7047dc587ee", "comment": "Malware payload (GoGra)", "value": "1e8a11249ac38ca948a10308cc333a47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938931, "uuid": "4a4301f7-dc15-4a85-8d6f-de254e5f5833", "comment": "Malware payload (GoGra)", "value": "9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938931, "uuid": "75b4983c-f910-49ad-b826-1550d56d2342", "comment": "Malware payload (GoGra)", "value": "4d9ae84166f2083a1ee7f3e7a0b3581e4b41bc4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938931, "uuid": "12070f46-1827-4fe4-a990-c5c47b2fc547", "comment": "Malware payload (GoGra)", "value": "cd4fabcaf0ad5d7f7ddd10063f16fb44597a4cb6aae164bd7c74740caad2177f5633a18d67af2f2e2353c3d1bd8e095b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938931, "uuid": "117ef8be-f01c-4d3a-b888-4fdd86839455", "value": "T142764902FDCB54F6E4075A3105ABA26F67316C054F24EBE7EA407B29FA77AD11936308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938931, "uuid": "f3e894da-e441-43b9-ab35-3e4d10d72907", "value": "98304:jPxoLUMn741MC2X86dZnIeAsTi9U2luEDjR:jP1ySoLn91Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938931, "uuid": "11bcdf31-be51-4808-9824-063ea1a5b060", "value": 7819556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938931, "uuid": "440c2b3c-3e9b-4385-b7b8-6091c238c78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938931, "uuid": "cb0cd035-bc59-46e3-b6cd-54dfee6e11b2", "value": "9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffc37bc-3ece-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776919232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919232, "uuid": "1bc45f56-a2df-449c-9ba2-8a0f38a688d6", "comment": "Malware payload (RemcosRAT)", "value": "710195a56bfca62db68cb46996c9f1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919232, "uuid": "cad4bcf6-44fe-492d-a0b6-b7ebc53d0e7a", "comment": "Malware payload (RemcosRAT)", "value": "9c34217aa9597c30ea9bcd7c785d64c3f974bec1312353bfa16018f896ea0dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919232, "uuid": "792c8d7d-3d72-4d4b-9673-dcb6e90eee57", "comment": "Malware payload (RemcosRAT)", "value": "7483247d80f5e75edbfbcf6f3552358372fd902f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776919232, "uuid": "7799312d-8868-47ef-bb36-7121389bdaa1", "comment": "Malware payload (RemcosRAT)", "value": "b94c9f2591da06bc3dafb57862e9720f7cb744cc670b76dbc5f7366c69fef7bdf0b77f70254b2b7c2a5f7a3466a97b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919232, "uuid": "5de8a958-f882-4378-b5c7-2dd9e4183aa7", "value": "T1B8B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919232, "uuid": "ea01e943-2e60-44f0-83fa-9926006685ba", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919232, "uuid": "bb43be95-6822-4e42-a194-33b41c03f080", "value": "12288:06pxxGI8gvGOHJpAbDYGxLhZ+sPZtSmPFN:06pxxx8U+bDYGxLhZtZDPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776919232, "uuid": "f1243a0b-01d5-478d-a9f7-494b889ab774", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776919232, "uuid": "caeb0a47-70cb-4322-b4b7-1e96db54aa14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776919232, "uuid": "226a8e55-e748-4fe5-bb8d-681fd91177be", "value": "710195A56BFCA62DB68CB46996C9F1B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ead0053-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963414, "uuid": "434c3ee5-d4eb-4fe6-a39e-5d27279d7338", "comment": "Malware payload (Mirai)", "value": "50140411956f16524b91c9ec39d3e470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963414, "uuid": "dc8b13d3-0102-42de-bf82-42fcf863d388", "comment": "Malware payload (Mirai)", "value": "9c59f0253c0a4da4c2225b49432fa395b3738389901c402f6316f8b5db862bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963414, "uuid": "cab41f58-0b4a-4232-957c-97cd90f94d0b", "comment": "Malware payload (Mirai)", "value": "f41a65e33478217a23918a726f1b79f8ca3a431c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963414, "uuid": "8cebcf19-6931-4179-94c3-c43aa41f5e14", "comment": "Malware payload (Mirai)", "value": "bfa8dc0984c31670ef082747a5537db1c1fc5557bf76020810daa140fef33f9ce448e4829d06b2e0e4846555b4ea2c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963414, "uuid": "0aadf20a-c6e0-413b-b50b-ad42d7bfea2d", "value": "T12C530891BCC19A13C6D01276FB5E428D332667ACD2EE7317AD162F11778B82F0E67642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963414, "uuid": "f93a6637-9bc5-4457-b4a1-24556ee3eed8", "value": "768:Z5MK4WsXHawudLng7lBbTcewdqVF5WUJ0hVCqYHr/NRFocFAUdJ7MUvg7r0+ifmJ:jD4VZML48ewdMXNJuUAUm5iuKfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963414, "uuid": "c79f8032-d75e-472f-a512-9c4cac6337f4", "value": 60844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963414, "uuid": "c5d2e65e-2e8f-4e29-bbf0-a90eb33fb640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963414, "uuid": "84efeb56-ae2a-4771-85f5-27f073625413", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf99f554-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935203, "uuid": "6bdd19de-3f6c-48bc-9a37-cf6e5c2c4ffb", "comment": "Malware payload", "value": "763a239f477bbddeb71ac3d4d325356a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935203, "uuid": "783621f4-464b-46b2-967c-481a06fa3217", "comment": "Malware payload", "value": "9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935203, "uuid": "d9008423-caa7-4e41-a8b3-1789cab338be", "comment": "Malware payload", "value": "07d285943263245d0382555501efa850ee78cafa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935203, "uuid": "e6d5620d-9509-4898-9634-7ff9689a3155", "comment": "Malware payload", "value": "9a1043943f1debd99c5e42063d161ee80981dcd5b598109c462a93f18291ede7beee6241a5daf98d346eb8c25bd04f9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935203, "uuid": "05b98dc2-d719-4693-b68d-6e4d08e99606", "value": "T1CDC18022DBE91522D8BF4B3CADE21B8252B4A4480BB3476B1DD852076C974942973BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935203, "uuid": "134b16c9-24a4-4452-b858-ca10687cf4eb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935203, "uuid": "8f167a47-a48b-494b-a80a-c3370ed02c6e", "value": "48:6fZpcrzSjsj84XdCXVZPmXBkrZRJrLHNrfoQmkugzNCCYShXwiyaaZlqglSto4Tx:Vmjsj84iHm+F1mk5Xwj7S3G1G+nK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935203, "uuid": "df5caf5a-794d-4a97-81cf-6b46638ab116", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935203, "uuid": "69a073a0-d55f-4620-adbf-4bca011ea4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935203, "uuid": "b597d377-e184-4bdf-967e-79542f8a4cda", "value": "9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035dfd9f-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968388, "uuid": "c38527a9-573c-4a02-a081-45965c257b92", "comment": "Malware payload", "value": "4dacc8a268c4b42bc43610b6ef8e8984", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968388, "uuid": "08f69893-c157-4fbb-bb1c-a80a7fa40119", "comment": "Malware payload", "value": "9d3f0d7a99c12c031b92f855c32971de7bd6bacdbff0b54482ecfe75497662d5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968388, "uuid": "e6619a9d-48de-40ba-b534-ea373ba202fe", "comment": "Malware payload", "value": "0c26a8e78eba2b13daca4187909adb46ea77ee43", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968388, "uuid": "f6e0627a-5487-4b0d-94e6-cf3aa2090d37", "comment": "Malware payload", "value": "83361110f62bf1bdeabce016d89720c87d3cbbc75b51e0f25e98fe2e4919dc1f3b273ad1f280da809c7f213ee2c38850", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968388, "uuid": "731cee89-e3dd-4afe-92f3-b0b53815ef72", "value": "T1449612D6FBD8992FC4771173CDBA46F215864C1289438F576948331C28BBAD84F8ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968388, "uuid": "1c814bf1-cf0c-4988-9702-e4a0f58ee1ad", "value": "196608:vKRLIQxUXqeVzEQRDCXFH/hxPmwlpG1rzOppILgpTr:vKyQtQFCX9SKpWKppIUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968388, "uuid": "4615ec9d-68c3-4787-b9be-8846e7385661", "value": 9350034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968388, "uuid": "fb95129b-a206-4d41-be72-49e688486a09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968388, "uuid": "88ab0046-27ed-40c2-8281-82d98e7b4591", "value": "9d3f0d7a99c12c031b92f855c32971de7bd6bacdbff0b54482ecfe75497662d5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708454af-3f51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776975443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776975443, "uuid": "cc7957ec-302d-4004-91fe-a9c60fc89b78", "comment": "Malware payload", "value": "31a967d51e1b311635453804417cbac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "timon-ma-gov-br", "colour": "#B48573", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776975443, "uuid": "19262beb-ea98-46f3-b5c8-4b23e4018f19", "comment": "Malware payload", "value": "9d3f0f826f3c154499bba1c241ea658ce3d3639489cb19b79eb4534e9402f6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "timon-ma-gov-br", "colour": "#B48573", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776975443, "uuid": "1950c107-166a-4a3c-987b-8cf1e28ca5be", "comment": "Malware payload", "value": "716591b974ef710ac99332fe5f305994927dba14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "timon-ma-gov-br", "colour": "#B48573", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776975443, "uuid": "d1a5b755-94d8-4934-8f1d-d12d66f28103", "comment": "Malware payload", "value": "fe790e5581bd6bbc15530af60b48ee9c25f1c64f8929c0302b7806f003c86297f7b0d9e467a7495989e6360f8cda4286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "timon-ma-gov-br", "colour": "#B48573", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776975443, "uuid": "533daf0b-8f21-4176-89a8-82ab70c1c94a", "value": "T18CC7333BF19A983FD12597717AB39161553BB910A4028C4692ECF8C8CF791B11E3F68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776975443, "uuid": "7cf7cc9b-e2a6-4b34-8c35-875e730dc68e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776975443, "uuid": "9ff10586-bf50-4749-8ca0-385faf2ceddf", "value": "1572864:sZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkmLC:sZTVLZuFbQlPjs+mLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776975443, "uuid": "22d64220-d447-472f-b9b4-c6ace761f4d0", "value": 56594760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776975443, "uuid": "77e8f072-99f1-40ea-922b-201c7ed38d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776975443, "uuid": "82e859af-86c8-4e66-bfc1-56832cf47d9d", "value": "CertificadoDigital_PCES.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338ceb88-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776964174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964174, "uuid": "39c803a1-fc0c-4042-b3b3-6620d3c6595d", "comment": "Malware payload", "value": "718f27e3109f2a0d2437321ebc8f13a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964174, "uuid": "181ffc81-034b-4a70-915f-2c014edbd7eb", "comment": "Malware payload", "value": "9e60cc525115f56d7c3e8a6066eabf7891094755be14b2dbea07d231737d44b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964174, "uuid": "7849724d-66e4-4462-a0cc-61f82554e43e", "comment": "Malware payload", "value": "6cb3f730046add9130fdc47bf55a1b98b62f1a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964174, "uuid": "1b96b25d-3918-4581-b3d8-a0c564cc6bfe", "comment": "Malware payload", "value": "fb4c31b4890e5ab7fce7bc991df0417ebaccd443373067f73069f80b6a7ff91b1cd73fc775ceacfebcd0d38e0bf98c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964174, "uuid": "f5440ad8-8ea5-4e79-8a81-22863c544447", "value": "T1F4924BD9493850C6DDABA83182EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964174, "uuid": "793470e1-14a8-4cf4-9bc6-aeab939e219d", "value": "47c3554d0dee53d4f925ed52484bea12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964174, "uuid": "2c4ee55e-1465-44c3-a650-3145424ba162", "value": "192:0Np/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:0N85rVXcLr7GBJ1ah3yqvDyR9za/io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964174, "uuid": "5d4210a1-3573-4999-811a-3b8a7ca90a00", "value": 19672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964174, "uuid": "659f16aa-2aa0-4b20-8225-6f3382ee25e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964174, "uuid": "afcce862-37bb-4d96-a15d-0081115aed7d", "value": "ym691vwka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a2b661-3eef-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776933245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933245, "uuid": "b9705289-0db5-4d0b-af68-f0b439c0257e", "comment": "Malware payload (RustyStealer)", "value": "88967b1ed62d1ef0d660b8cf0e0f3744", "object_relation": "md5", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933245, "uuid": "bb0b4e29-c01a-4c7f-a265-ad3380adceb4", "comment": "Malware payload (RustyStealer)", "value": "9e6b823bf63e26c8671bc97f1c5f07ade2b68851ccfacc583c1a22933c34b0f7", "object_relation": "sha256", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933245, "uuid": "dfe32146-7750-4eba-b08c-e3510241c404", "comment": "Malware payload (RustyStealer)", "value": "49d2b1340eada13493b9ce8b638e86b9484b3104", "object_relation": "sha1", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933245, "uuid": "431c230c-d431-4fda-b06b-b5a51b41d43b", "comment": "Malware payload (RustyStealer)", "value": "caeab5e9603ca51333cd650951811333ec6a41a268656605fd09463726fdded0bdc0c040cbe2eea8b50292cd7811add6", "object_relation": "sha3-384", "Tag": [ { "name": "69-169-102-14", "colour": "#C29105", "exportable": true, "hide_tag": false }, { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933245, "uuid": "c99dbb52-823d-45f2-8b61-0390289efafa", "value": "T191D67C03AF9A48E9C489C8B4C3578B674E2234CB1A36F5AF45C551293F6EBB11F2D319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933245, "uuid": "1d672f70-e211-413a-9f86-0decafe86bc1", "value": "8f0103956ddf07cba567da05a0616271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933245, "uuid": "c9a21cfb-cb96-4185-aafd-fdb28e2df7cb", "value": "98304:BRuxyHqiVDfaAw0PtbB1lKJKPtbLElUwZVn+pMq3iqn+iFHIO:zTvlVRB1cEPtQZFLqSgtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933245, "uuid": "8f63c725-c617-453d-8c1f-49cb66a672f2", "value": 12866048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933245, "uuid": "411fc179-19ba-45d2-8daa-d16000ac3a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933245, "uuid": "8788b872-cf4e-41e4-a7a1-07412c6e9f02", "value": "9e6b823bf63e26c8671bc97f1c5f07ade2b68851ccfacc583c1a22933c34b0f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4879948c-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972370, "uuid": "e8d34372-dc79-4f51-af4c-c8133d477ad4", "comment": "Malware payload (Mirai)", "value": "fc3542c93b19f48208ddb9d4b6345b9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972370, "uuid": "14973ee7-c685-4d7d-bc7c-6dae1a1ad265", "comment": "Malware payload (Mirai)", "value": "9fac8301b0ae19065fe1f37c7e3e77335c50fa0d22e1c94d0c87ecdffa6fefd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972370, "uuid": "8eea1b39-5853-4f31-8bf4-f1e0014038e7", "comment": "Malware payload (Mirai)", "value": "685b7425c5defec3482c249ffbd3879574408c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972370, "uuid": "47aba7fb-466f-4320-bf92-10b4a26c39bf", "comment": "Malware payload (Mirai)", "value": "fd34fa2c8d9c23aacb72c8bc634ac76d18751aac962e3b0a63662348b11c938856c0cc4247dbab666a83721952ebcc5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972370, "uuid": "5c63dfb8-96ab-44ec-876b-135b50408572", "value": "T1D1F30985BDC14B13C6D622BFFB5E429C372657A8D2EA710399225F20378B86B0F37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972370, "uuid": "ad3127f4-5569-4c61-8349-b09d76ee9d6c", "value": "1536:/ux+FZkenU4A6Y3fkjkC5gFZYiZqW25fH4VOhEcTq+XBf4BK/fBAeQltzwywU1Ir:/ux+xARfqkYWqWc4KPO+XBf5pAz51s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972370, "uuid": "ec40bb72-12c3-4149-b97f-e8d5e2fef8b3", "value": 162400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972370, "uuid": "c6a6d655-12f5-4432-af3d-db9707684144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972370, "uuid": "1c89f314-93b6-49ea-b6f6-403e0c83136d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59b6c82-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776934328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934328, "uuid": "619fd1a6-8e66-41f9-b5ae-31b6f5c40aec", "comment": "Malware payload (Vidar)", "value": "d66f84e6e3ad1aca4f0862eb421a5b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934328, "uuid": "8fe1ad1c-8b10-4df5-aad1-ac255f2ac29c", "comment": "Malware payload (Vidar)", "value": "9fafc7d772a966ae18b1af69c2fb1204a651fd5f33710a714e6e0a211a3d6e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934328, "uuid": "9bb3931d-4ec1-44ac-99ce-564772fcb63a", "comment": "Malware payload (Vidar)", "value": "d4fb4214783c0fbfe0a5b205e6fc31c7a0e21f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934328, "uuid": "715120be-bfe7-4ced-ba05-427b83bc08b7", "comment": "Malware payload (Vidar)", "value": "a39cd4a9f2408ec661b2be41400e8ee41fb5902bded21e54e500e44fe368e66f591fcb5a2c74d904a0413e70b24bd5da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934328, "uuid": "e71fc590-8177-4adb-8ab5-6152571e5f09", "value": "T119D42ABD9C60E336F60CD0BAD287E7539F2138001236B99319BDA7241246572DB677EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934328, "uuid": "8bc0e2ce-6989-4839-b6e3-7987a56cc044", "value": "12288:Cq4DrYI6HlXEHDm86s9MrOXrzTPaM+W31CAG/JUQI1:d4DrY9lXEHD96wMrgrzQoG/JUT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934328, "uuid": "12e5d2c4-5843-46c4-8506-cc4c6e3dc339", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934328, "uuid": "57b2f700-1e67-4980-8954-8ce5237ea7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934328, "uuid": "0e408f8c-4425-4c88-b4ea-7e4ace54a75a", "value": "d4b1c7d67b8b6d7fc996a4196990731605aa182f8ed48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a462da05-3f3f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776967799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967799, "uuid": "c68ef689-e93c-430a-a0f6-1a67db21ee87", "comment": "Malware payload", "value": "998c7c50b9a61fb36c476e5ec95935b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967799, "uuid": "2ea867cc-9c6b-4106-9fc6-2ba08f6591aa", "comment": "Malware payload", "value": "9fbe336a8b60e6000138150bd544689b386bfdc268f6f585bed478d291365f2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967799, "uuid": "abefa058-8af3-44fc-9d62-b3e566b3eb82", "comment": "Malware payload", "value": "2090619120ef609a901edf26f5d2dd63e87d2101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967799, "uuid": "69694e1e-953d-4192-8f31-36ce5d39b6c3", "comment": "Malware payload", "value": "dcfedc09d8a592769549fee0b5404f3837e143bd9dbabc8ac98e8c9c713a25a51df621073740b2a7f12d24c8c7939ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967799, "uuid": "50d093a0-265b-4859-864c-2140831161c0", "value": "T17E53F1ECB30358E2D21BE6F382A103507E72DBD20215FC477634B565CAC649EB4A66C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967799, "uuid": "07aa8304-7499-4c6e-a9cf-17b9f09bdfd6", "value": "1536:Yijk18NUPIgKVi619u93OC5LQU+A1uDVrY1:FjkX16+r5LQU+KuDVrY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967799, "uuid": "38236725-889f-4028-bdcb-9cfd1cde33e0", "value": 61812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967799, "uuid": "fed1979e-36f5-462b-b28d-88bee3aba7e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967799, "uuid": "a3eb072a-6174-491d-93a9-9e080ec6f0a9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1920dfcd-3f2d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776959835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959835, "uuid": "716bcba3-71dc-40f4-8b18-5f27a69789fb", "comment": "Malware payload (ValleyRAT)", "value": "af26fc58b8a6ab7aee608bbb1e4a55b7", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959835, "uuid": "122510f3-7f40-4473-871c-49451316796d", "comment": "Malware payload (ValleyRAT)", "value": "a0123008f8163d03b606197e516e314c46ea92fa8ef609221150207010dbaaa8", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959835, "uuid": "e4f69c97-6b6d-435a-aa73-2f16fd0a6ed8", "comment": "Malware payload (ValleyRAT)", "value": "26bb5817f5508b41460af6845547d5ffeda01ce9", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776959835, "uuid": "6133d4dc-b552-490c-a120-6e50fa1c0649", "comment": "Malware payload (ValleyRAT)", "value": "7f0a578f8738d3401e5fa0666aea09132b24564cbe0df45fb5a86c698a2912a3a6fbab76e8275b651b43bd630b5e0b9c", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959835, "uuid": "0f16d6f1-b1bd-4aa7-bf0e-29f16684d6c4", "value": "T11B158B05ABE806F4D67BA634CAB55233DBB1B8551774ABCF0654D21E1F33AC06E3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959835, "uuid": "02eba4bf-b8ef-430f-beeb-c641a6031b6a", "value": "25dbf2910ece27ca3b6a4debc81bb604", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959835, "uuid": "d12482b3-71ad-4ea2-a46d-503cca587edf", "value": "24576:8mP5iBVIOZP1d21H0/KjF+lolPYJ8FupI:8w5Yq0/KjF+lolw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776959835, "uuid": "dfb2b038-9937-4002-a0e9-7c0d719d4b15", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776959835, "uuid": "71839d10-746c-40e3-bb7c-015c2c81120a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776959835, "uuid": "090822b3-f252-4d13-9dcd-1429a5d2557d", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73985ad-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776929713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929713, "uuid": "fbd1b197-3446-4284-9749-0204f6e5febe", "comment": "Malware payload (Koadic)", "value": "be912acab4a556d993d51a6a28a94908", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929713, "uuid": "6f0479b3-7624-47a2-aa2c-4d766fd85fc5", "comment": "Malware payload (Koadic)", "value": "a018712ed88611c53cbd487acaf9bf6220a25546a4995bf9fe7ad92c99054fb1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929713, "uuid": "f4cdc931-b584-437a-9f02-e4b2a6a408e3", "comment": "Malware payload (Koadic)", "value": "2fe6dccd8c1566974b1b7eb9fc27d2bd8e0df1cc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929713, "uuid": "39747e6b-9908-4d2c-8c3d-c0677225ec79", "comment": "Malware payload (Koadic)", "value": "949a28b0cd6bc030b5756779e52d3b1c94b88fe6c6fa6648e3a1fda23c72209445c68c046b190d1eee287f5487d18086", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929713, "uuid": "43df938e-4dff-42b7-ac47-13896295aeac", "value": "T180F130285B43313F74261CA1EE058F7A62063F7FEC89F5E6368AAE514D3664D14A2F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929713, "uuid": "55996f07-a45d-4688-85f0-40c85e8a266d", "value": "48:XINCBgascjYdOf4Z2OKpmG0m/YdFaKU2C:WXHkfvSGrw37C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929713, "uuid": "57f79229-428e-415a-a701-62ddff43b8f2", "value": 8038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929713, "uuid": "88496c3a-2420-4196-ade5-a4b9d03fced1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929713, "uuid": "d1005ca2-87a8-4c4c-b985-9da473b73692", "value": "HSBC_BANK_CONFIRMATION_PAYMENT_RECEIPT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafa12ae-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944725, "uuid": "e95136a6-e148-434b-871c-37a3f63b2101", "comment": "Malware payload", "value": "9926e697110ed8b1b1ea3c7cea8c6c38", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944725, "uuid": "02109cc8-06c2-433c-a3a2-60e2b34ca274", "comment": "Malware payload", "value": "a03bd542c2b082b094632f90bbfa4d3cf197d402f66fddbe759b067562fb35b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944725, "uuid": "bbb85d62-8665-4ae8-8c0b-d148367275e0", "comment": "Malware payload", "value": "75df382027cbc1339973143f0a339c5b012fff31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944725, "uuid": "4d19eec1-4def-4218-9fe8-a5afdb257b95", "comment": "Malware payload", "value": "a66c44b8cd81730da20d410046bc7cda8b47247e13549996432d606c7297cf02c96b292a920916987d433b0c62ec8c91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944725, "uuid": "57b7de78-7a33-406c-beb7-73421132033d", "value": "T18F71340A9BE8462BE0BB47347DF343175774FD489FB3472E09804224ACA56A85E75BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944725, "uuid": "f042be30-d1e0-43fa-8b97-0d0ad8f51a3f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944725, "uuid": "cba8a8fc-16cc-434b-990e-bb2eb309536e", "value": "24:etGSP9Rzt31yOlquRAqAqO6gm8tkZfT65mogFDpWI+ycuZhNcrakS/EPNnq:6z73qQAqAqORmjJ25mXs1ulcra3/Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944725, "uuid": "c79e9170-d727-4c8c-9aa2-46cc0bb14e29", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944725, "uuid": "3ad71f67-58cc-430f-8c1e-02b4aa5bc006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944725, "uuid": "04b29702-6ec0-4c65-a937-c4adc4e84868", "value": "2slx2ohp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f795dc66-3eb4-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776908239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776908239, "uuid": "0371ad5d-62ca-47c4-861d-5df38182433e", "comment": "Malware payload (QuasarRAT)", "value": "22677ba9523d4c1e4ccd1ce31cc2c2d0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776908239, "uuid": "f076143f-8c9a-4389-a256-2ba2090064c0", "comment": "Malware payload (QuasarRAT)", "value": "a08cdda2d228917af29c34912fe516cc68f280c730158147832b1c9d83e2b703", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776908239, "uuid": "95fbd73f-54ca-4fb2-81ae-3414be3fb6c4", "comment": "Malware payload (QuasarRAT)", "value": "be5b4acace2b75a20de1643d59fcdcc2557e0a9a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776908239, "uuid": "35bab959-4bc3-41f6-871d-8e19f59edea4", "comment": "Malware payload (QuasarRAT)", "value": "8043cf893979640b7669dea407f23f78fee3d7f79840db3883bbf440d261c0c8242ba5755ba1f06fc6ec91432ca950ad", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776908239, "uuid": "a047049b-5cbb-407b-b7c9-23db90d8c2f7", "value": "T1ED41E6D90F44A5B809C246A3A17BCA608314D7B8313E7CE0BBC4C381E1092CF83AE4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776908239, "uuid": "09296056-a9bb-4c05-bac9-2d480ea6de37", "value": "48:Phua8hlOHGp8RZkdiPnPcKw7gUYtVD10nD5RYRCRxOStWw1APWURDYW5J:oaFmp8R2ho0D5uU7vw2APPDYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776908239, "uuid": "afa4e861-9900-4b4f-8b93-befee54e1021", "value": 1932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776908239, "uuid": "bc3185d7-09e2-444e-a933-35a403592a03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776908239, "uuid": "8e61e11c-cf53-4a06-a72c-03197acc7197", "value": "P0QXDWMcGsKAm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93e1ae2-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924509, "uuid": "c9c4bd5e-9638-44c2-acb0-568de1711700", "comment": "Malware payload (Mirai)", "value": "4359938183d56823d0db647a0471fa47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924509, "uuid": "ccb01f41-d6dd-4175-b1bf-56b8fb6512d6", "comment": "Malware payload (Mirai)", "value": "a09242343f0ce8bcdb0aa675c660e5fff1baef86ffb045e8795b314d82e665f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924509, "uuid": "62240b79-09e4-46f7-9f71-873284a123e0", "comment": "Malware payload (Mirai)", "value": "7f1c9c9e895de932fd16aa1babe00b739dade012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924509, "uuid": "a08abf06-2674-4d34-9be9-0fcbbd925365", "comment": "Malware payload (Mirai)", "value": "1a8b56379af0ee69f73f32f9a1ac7fae964721b422b3f20020e964e144451c86325df81dbff7b0c6db02d4fff9a6b63f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924509, "uuid": "2be203dd-2263-45c4-ac55-b3e3d9af52c0", "value": "T1CAA2E019BF58828BC832797455D9E5D21257FCA1F29DCC4D2940C15FF0A33A96434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924509, "uuid": "abbb3b86-d3dd-43f4-9ec1-4b7dbfae9520", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTV:798o08kxofBE+ZkXaITbp2F2TWul0c5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924509, "uuid": "8cf80208-1e40-44d4-9898-27a43909d10a", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924509, "uuid": "cfae7151-bdbd-44e7-8a75-2b9abb3ca0c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924509, "uuid": "c1cdc7ea-9612-481e-a74e-dad81638f4d3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b817ce-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963396, "uuid": "97b24a1d-5e72-4f14-b546-1bd0e7f02a37", "comment": "Malware payload (Mirai)", "value": "7220f3b8f2bd81b8ce6d011b0243c00e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963396, "uuid": "f8182b3f-29d5-4661-a550-0db615ce6716", "comment": "Malware payload (Mirai)", "value": "a0c7f4d61271ba17052c25df0c6b0d275a22455b3f94cde063d456dc07c69957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963396, "uuid": "8ad8c6d8-5dac-4f0d-85e9-310205c55aa8", "comment": "Malware payload (Mirai)", "value": "508e14df2a4368ec32590f14659eaa986323cf57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963396, "uuid": "d4fdbda8-63a8-4339-bfc9-010616be55db", "comment": "Malware payload (Mirai)", "value": "971b382da888368b173fc00cc15d3790caa97d16cd00c56de46b61bc20c2309f000d93ebd0279c317fd4656160ef5bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963396, "uuid": "1e99c3d7-088f-404d-a75c-54d730f8c966", "value": "T12E83F719BB914FB7EC6FCD370AA9170134CC591B22A97B3A7934C918F60F64B06E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963396, "uuid": "0191f825-4f35-4346-9c1c-b44cd5b843ac", "value": "1536:p7UMCN+nMZHavzjkIPLMb3dJLEbqP8AvJW5coYZl2s0CVEJNl:p7dCN+nOavz/U3dm5coYNVANl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963396, "uuid": "bc9eaa34-fe4f-492a-916d-c8f6dccfdcb0", "value": 81928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963396, "uuid": "8531794d-7514-4393-a8fd-7a89086483af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963396, "uuid": "f87271e8-225c-4843-b046-a506f6aeb136", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64a6803-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938302, "uuid": "f4a3b313-e6fb-47bc-9f04-7f6c1be3c883", "comment": "Malware payload", "value": "88dd62a7e8b611e92516811527afcfe2", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938302, "uuid": "a3ff22c4-e172-45a2-86ff-74780cdc011d", "comment": "Malware payload", "value": "a0f4353beddcb8404af41f6731fb83731e8a9a934ed77757ca3fbddc050157e5", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938302, "uuid": "bfaae085-8080-41b4-bf8a-026168b8932d", "comment": "Malware payload", "value": "807d8d9c2b238425b3c5df719c37222137b47b22", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938302, "uuid": "6344995e-12ba-4506-9a82-ed858ac8e828", "comment": "Malware payload", "value": "5f6eafdacc5d4d5c0e51c474e3a74aea39bdee2a7648ffdb7e06cfb337860ce4433b2d694761fe1a33782594f90ea016", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938302, "uuid": "f1623839-e03a-42d6-ad07-1555c56aeb89", "value": "T182572B17E9A541A4C5A9D574C6359223FFB27C88973033DB6BA0FE142E76FC0A6B9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938302, "uuid": "a447ad5e-5cbc-4a4b-863c-332dcd2973d7", "value": "196608:nMD2xGu4CfQS8FlS57lSX/HlGxb4kf8UoM:G2xxZp8m7lSX/FGxb4kfPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938302, "uuid": "c2cdc385-6b3e-42a5-a506-431d4c85191a", "value": 27799704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938302, "uuid": "9defd877-7f96-409e-8169-aca5b3ddcfe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938302, "uuid": "ebfee302-c9c0-49c7-8690-4419d35ab61b", "value": "a0f4353beddcb8404af41f6731fb83731e8a9a934ed77757ca3fbddc050157e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72820f1-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1776954060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954060, "uuid": "3fa5bf84-3f67-4ee0-9f3a-e83382855228", "comment": "Malware payload (STRRAT)", "value": "e38a8e4a9819f8337c19ebb8897a98eb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954060, "uuid": "bc59ed2a-58fa-4e32-b6e6-9bc8668d8da7", "comment": "Malware payload (STRRAT)", "value": "a1178160813e5ba01b87da5d107622fe4634b7843432d215ce428e2964405b95", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954060, "uuid": "e3c40a35-4c2e-472e-97db-40287bf215fb", "comment": "Malware payload (STRRAT)", "value": "c76f470119aa124ed634f6788e56beeca634e9e2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954060, "uuid": "8d0e83c9-7d67-44ca-bf8c-6de262fa2ec0", "comment": "Malware payload (STRRAT)", "value": "816919203cac86981cae56a408fceb345b16785e9607b1d7559d159fdfc946d5ea24dcf2fffad6eb76e3192f7b3b07e5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954060, "uuid": "d90d0954-f514-4b58-99b2-7432cbaa23e0", "value": "T13B5375867B44D076E7A3B0F28B58920BB974E4EF9155A1C70EF0BC9DDC698420FB26C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954060, "uuid": "b625917f-bfea-4783-bc94-200b0a63917c", "value": "768:NRsy/SFc9WQ8mhAjWWPHDjTHRMcLLWxGCh42iHSt0SD0O97n/7oloEV:ky/CQQWWPHHrOcLLqph2ytsOp/7oe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954060, "uuid": "6935c9f5-bfa7-401b-8746-56e358f8f6d7", "value": 63597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954060, "uuid": "ea51c2a4-95cc-4ed5-87db-9ed7cc0325b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954060, "uuid": "4f7fa761-d817-44d1-9624-fc5c3c2a557e", "value": "BL.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d349ef-3f3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776966032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966032, "uuid": "824ed246-7e77-4b04-99cc-c29082c33a84", "comment": "Malware payload", "value": "f215c6d3bcec73d318e757243fe01174", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966032, "uuid": "99da3632-521c-415e-a974-bf059d7fd9a4", "comment": "Malware payload", "value": "a196f8d8d998682107a5f6bb9003dde10ae5f6b0f979022eae42d5b795c35198", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966032, "uuid": "56c22492-7162-42a1-925b-f7c3b1d375b8", "comment": "Malware payload", "value": "861a71aac9e8e1165ec4e2a814bb7ccecc2fa36e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966032, "uuid": "cc00b33b-1ca4-411c-a8ae-8c42d0cde0dc", "comment": "Malware payload", "value": "0c4e17b6c7b35bf0a97e5fc660fa333788b16a488abae7d39a51cda435319984929adf7fdbd2b32cb74073b1f16c4c27", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966032, "uuid": "b41bab5a-afc1-4398-acea-bde2fc3c1a11", "value": "T1EB24092BA3A34D78CA57D1768296D7B2A831FC140334F95F0654DB323F2AD684FAE548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966032, "uuid": "74cce37d-445e-48c6-a75f-fcc87d4bd03c", "value": "14117968c52953e451d195099ac0c3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966032, "uuid": "7cdf4f24-49a0-41ce-b326-39663d3e7a8b", "value": "3072:HpbHhykKD2n5/AE5IiE9CQ3ldStnFTf0NlJxQa2fQ7RC1Q7ZLB9U0slvLy7oz4J+:HHjI+Tf0vJKvfQ7RB1B9U06CJP5L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776966032, "uuid": "836091ab-d0e0-47ee-b814-bba24ccc46d5", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776966032, "uuid": "71d38ee3-a9db-4f2b-955c-cec0e0221113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966032, "uuid": "77e7d373-9007-4561-b7a2-43919ba184c4", "value": "cache.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf07c02-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935169, "uuid": "604556d2-41d2-4eaa-91a2-522fbd9d3391", "comment": "Malware payload", "value": "d60fcb3e1160cdfbd5c32e641b0815d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935169, "uuid": "276e13a4-6b1d-40b3-b9a2-e95219893735", "comment": "Malware payload", "value": "a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935169, "uuid": "f22729c7-255f-48e5-a9ed-96c082d5a498", "comment": "Malware payload", "value": "90e8c7aa689ebf7f390e44bed03ae7480914d1a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935169, "uuid": "bcf97d60-d07f-4e65-bb6a-736dd92d3afc", "comment": "Malware payload", "value": "db2eb32c620fbbab4a5b4af16b14dbf631e68628b600709f9a77cc3e9aa5c3dd1f44708629c056f4d97e0049b3c23f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935169, "uuid": "aa0bfb57-dd37-4daa-a1e5-7c642e29c92c", "value": "T1E652DBDBC3D12200E756F2702A9B11A66EDFF8848770526ED43C255F5CB03FE32A5A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935169, "uuid": "f40af4e9-3268-4e96-b0bb-0c38d72a29b0", "value": "192:2n/Xa6krkrsYq+5y5QL+nWa0JfdO3vq6mZ5p1JhZb7n1uuvyXJYIQYj:OIFiJhdz1uuvy5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935169, "uuid": "b9207218-f1d3-475d-962e-dd1127f7be4b", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935169, "uuid": "8b202986-69f0-4170-81ef-ba308eef0b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935169, "uuid": "77f0cbcb-cfa5-4982-9310-202ed80e324b", "value": "a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b862f33-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776928620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928620, "uuid": "6b273bcd-a449-4da7-a5e3-8dec3aefc292", "comment": "Malware payload (Phorpiex)", "value": "271149e7b06475232f43b8595ef6515a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928620, "uuid": "5f0b91be-0a52-404b-8d25-d83b957d90ae", "comment": "Malware payload (Phorpiex)", "value": "a20ac10f807be5f93843283a92d8792310b2fddbad783cd305c130fb7835ef0c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928620, "uuid": "dd5684dc-02fc-4be7-bd00-8b7802977cc6", "comment": "Malware payload (Phorpiex)", "value": "2671dd62d6b5029fb8ce10d24542e5c5d9fbe7c9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928620, "uuid": "8956f4ad-53b8-43b2-8a94-543d5b15a2e3", "comment": "Malware payload (Phorpiex)", "value": "17f4b43d4bd27abbfaa77c35cfc5b09e07e32af8b59d8bcd34ac0db7f24272f25f8d11b990d4fbe48020934d4db49bab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928620, "uuid": "a8216a94-ef94-4c0b-abab-e389852f2a26", "value": "T1CD825B0FB942421AD0D100749636867BDAB998B637D814EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928620, "uuid": "8d46b75b-cfcc-4720-9ff3-573632996868", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928620, "uuid": "0847446f-f1f1-4489-b12d-18b4dde89651", "value": "384:eI7MVGASM1KwngSZb7u9NHuagRhav8U9ce:TQ8Ub69+ha0UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928620, "uuid": "0745a750-edef-445e-b617-efac7d3c440b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928620, "uuid": "fae894e6-ff45-4ac8-8100-56e9f6ba7a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928620, "uuid": "bda3607f-c780-4bf0-9678-eb4127dc64bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f853f3-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1776945982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945982, "uuid": "8c2e181d-0d9e-4fa8-ac26-07dbeda806ba", "comment": "Malware payload (Grandoreiro)", "value": "db7b5afae4e0834c06bcd26b31743c6f", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945982, "uuid": "82152fcd-d466-4c6d-bbab-805abce96b82", "comment": "Malware payload (Grandoreiro)", "value": "a282e5322050db365bb8464cd79f5d6b89bfc91cce591477f924f3a7f36b8363", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945982, "uuid": "e9af0b2e-171e-4618-b020-913664133631", "comment": "Malware payload (Grandoreiro)", "value": "62ca43ff5291da0c300298e26ac72398874a1086", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945982, "uuid": "846f1107-1681-468e-8796-5e0a6bb38bfb", "comment": "Malware payload (Grandoreiro)", "value": "353a40ecb40ef6c84b5b2d795ecd31dc2d36b8d4ea829bebe5e4bc369f2fcf256a82b85bee83b8bd42459b4d3d07fce1", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945982, "uuid": "716fd0c4-31b5-4d8c-997d-71a7caeff41f", "value": "T127D533380170C9A0E506BDB144E6776A22A7E3C36CF4A136F53B511C527ADBECDA5C2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945982, "uuid": "710738f3-51fb-4cc9-b74a-4b4640ffcb47", "value": "49152:E5UVm07nz3pPIIFghy5iA69ovSEKZKHJR2sDMfC3dl0NlnnUbX+T0FOxhe:E5UVminTRPFghyYA62vpK0msAfC332ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945982, "uuid": "c5e478c6-bb72-4fe5-87aa-2099263f871c", "value": 2895936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945982, "uuid": "c59863f4-f857-472d-94a9-db1c8740d7aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945982, "uuid": "3a60fee3-a806-415d-a524-7cd46351fbeb", "value": "_trZdU0PK$aBYDH8S3AuA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daa4320-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934905, "uuid": "c3ef4ad1-af06-40a0-a65e-39da921edde6", "comment": "Malware payload", "value": "dcdb49748da4371f41f565d75553252f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934905, "uuid": "85abc775-d5b4-4352-b3a6-220598748da3", "comment": "Malware payload", "value": "a292c58fa0f0667449e0492d03d141ecd81a48abba023b46594d53e2313009e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934905, "uuid": "689052a6-d70b-4948-8ea3-3f42e28f5b4f", "comment": "Malware payload", "value": "83c84c76b5f6a5ed44cc9f571463adf82b17ff25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934905, "uuid": "5fad88f9-241a-4e03-87d2-cb1385937d23", "comment": "Malware payload", "value": "6b146e0c6f83b968d2e67cdc9287f7bc786b4b733fb905cf69d89e6a5806818dbecd8419468ed770f7d85d4713cd58b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934905, "uuid": "66277946-7e05-4ba1-aad7-8bb9e210a931", "value": "T16F07AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934905, "uuid": "7c6663b4-6afe-4f8f-9936-6a2f018ec965", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQF:cqYUQuVDt0TZES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934905, "uuid": "ec70a1e2-8f00-4c01-bd18-3b5cf7300d23", "value": 18153472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934905, "uuid": "efdd5c6a-4f92-4f9b-a8ae-ba17140c4427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934905, "uuid": "8e1d63d2-6fb5-4d65-9f36-f28d817ea8de", "value": "a292c58fa0f0667449e0492d03d141ecd81a48abba023b46594d53e2313009e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebd5bd2-3ef7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776936705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936705, "uuid": "28015bc3-608a-478e-a387-b6634f6b2d6b", "comment": "Malware payload", "value": "4729cf8a12ba6887a8649452ff8a6b83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936705, "uuid": "d003c046-59c8-43a7-83c7-e8804b6df363", "comment": "Malware payload", "value": "a2babc42eb2b0d046031c60393187f56b88bcd3d086559ce2b45253d9de6b3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936705, "uuid": "e3a80f7f-7811-4a0d-a46c-e85b0f3b6038", "comment": "Malware payload", "value": "f85fd1895d5bc5648b2719ddbc15f1fab4ef6f4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936705, "uuid": "958d723e-7172-4679-b17d-ba4c2c8dfacf", "comment": "Malware payload", "value": "0107d5ac63ecf71a6efcd1119199d02afdb8517b79edfb5c833c64e11295a335d95b2f8aeca9fdfeac260b24a6df3e07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936705, "uuid": "4ced1384-4fed-4cf6-8736-76f169032ea9", "value": "T1F3C68C77914238E9E4A98CB4D11025526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936705, "uuid": "ae7842b5-7ddd-4bd7-8bad-7c025b7ca085", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQb:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936705, "uuid": "c2f07ca2-26b0-406c-99b4-cf98055886da", "value": 12451840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936705, "uuid": "b4a10fad-8107-4fed-85c6-0d2ab0619fc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936705, "uuid": "5ad98d5b-e6b8-475e-8365-6c05fab81ebe", "value": "a2babc42eb2b0d046031c60393187f56b88bcd3d086559ce2b45253d9de6b3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51990a61-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935019, "uuid": "082b0668-f965-4f7f-a8c9-2600f69ca294", "comment": "Malware payload", "value": "1809abc619609494b0aee5257a71d097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935019, "uuid": "b058417e-bdfb-4368-a66f-5f9a8501193d", "comment": "Malware payload", "value": "a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935019, "uuid": "bfeef38f-5acf-4524-89b9-8a79a05dec5f", "comment": "Malware payload", "value": "8f6941f7c5dccb1bcc9c141a334f2a947739b377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935019, "uuid": "3ec84a40-23e6-42f7-9dbd-d4bcdbf67d8c", "comment": "Malware payload", "value": "4ddadb617c9e74574befecee8110cc26cf6ab7068b074f05a61222e2aec1340a8b5bd70bb443c885f7dad81c20decb33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935019, "uuid": "f3e30c92-62a1-4b23-95b1-327caa57a905", "value": "T166523507D9D6CC53EE254B34C8EA90B436B7D8516FB3F307A9EA626E18133C05D91B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935019, "uuid": "a3ad0cad-3635-4e69-a1d7-bd8005111793", "value": "48:iRnjhFDZjuqdteHaIDuhmDWcblhuyO/dxwprT6xUAyxVeJr:2n3DMaIDuhmK2s/YE5yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935019, "uuid": "c703eaee-ea03-4e36-8c45-da37be35e1b6", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935019, "uuid": "0ba09a0c-f770-4224-835c-23d3ad84fa76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935019, "uuid": "d39df9eb-6605-499e-a5e7-cc26553304ba", "value": "a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b752cca-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776931465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931465, "uuid": "98ca2f3c-71e4-4f88-82ad-c3bdbb621adb", "comment": "Malware payload (AgentTesla)", "value": "528c28be80e41f4705fe7eb944d77cb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931465, "uuid": "0cee4ba5-2e3c-45d8-ab2b-90c4063c8890", "comment": "Malware payload (AgentTesla)", "value": "a3710c24ece8768bbe41f9431ff4c203b5676b0354050bb3da09ca17c4d1c7bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931465, "uuid": "88c6d133-4959-4f5a-9eae-d6750c1dc422", "comment": "Malware payload (AgentTesla)", "value": "01f6c9b643077b23d7d7d56b079def9983e74e38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931465, "uuid": "b016f1be-e727-4c93-b56b-c659aa2978e0", "comment": "Malware payload (AgentTesla)", "value": "d40e295a31ddbaee3ca297c99673e5ca4946d9289d343d06c1386b5281d047aef8b236a6a38cac78f5856f7f3b3ec83b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931465, "uuid": "05ac8e9b-06e5-459b-b0f8-686f4fcae5e3", "value": "T17855021189C82FF9DFEC561C80BD160E63F05ADE5066B98AEB73BE47AFB7540110B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931465, "uuid": "634727b1-6c6d-4951-9abc-9c94dea1bbe2", "value": "24576:tJ+te/MNO73fk4Qz/89eWi7HIwNbzsg8rz1Wqp0nF6T+:9/mOzgT7IcMwRgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931465, "uuid": "b02edd13-ec19-48d4-8c88-4f8317d36cac", "value": 1286110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931465, "uuid": "5c85b4ee-f251-4a73-bf77-55f580a59950", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931465, "uuid": "94a028e7-ddc8-4239-a6de-61af58ef16a7", "value": "Vessel_Main_Information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cd19bc-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955880, "uuid": "55103287-c2b4-45bc-a70d-11098f1e384e", "comment": "Malware payload", "value": "23b69010f55d27d8921535ca7a1c9293", "object_relation": "md5", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955880, "uuid": "959f0f48-0048-4b04-afef-e40b6c0322e5", "comment": "Malware payload", "value": "a40a1655c9ca864e2254e4db3624a91d6818db159195911e0a94ca652694b63d", "object_relation": "sha256", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955880, "uuid": "4ac45f60-af06-43b2-94af-3b8ff8cda6ad", "comment": "Malware payload", "value": "2989bd6b5630dc567f310f5a3613c26292e481be", "object_relation": "sha1", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955880, "uuid": "15b4c969-9243-4a62-a171-51448dafd605", "comment": "Malware payload", "value": "dbda3520d1d629df75146f59d9fda4cda90294d4ed9e033ce217d4d3f067ccf28b147f0779ac373e076b3bfde9af145a", "object_relation": "sha3-384", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955880, "uuid": "113591b3-d379-4a15-82b8-9505415bd729", "value": "T10A512099AB262D30B95C057CE81A612424874F2352BC3E9076DF65289F1974FE373E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955880, "uuid": "9b53bdb3-a62d-45d3-ad18-b8b57cd673e1", "value": "48:YRaFMt1E3KKwyQ4B53hwNwrmJbYQAsqjm39zFYgAwAY5:YR8Mt1E6Hy5gbYp9jmNzFfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955880, "uuid": "88b63127-642a-4b6b-bfb3-295478abbb93", "value": 2463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955880, "uuid": "5bf6a671-1cb7-4306-8dbd-4a097ac57d03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955880, "uuid": "a4e2a0b2-6c74-4828-a094-0e7f0b039d04", "value": "a40a1655c9ca864e2254e4db3624a91d6818db159195911e0a94ca652694b63d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b182bc-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982158, "uuid": "62904607-8279-47a6-b5de-7925e00a3ae2", "comment": "Malware payload (Mirai)", "value": "fcb37bc995dade17e5987707724687e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982158, "uuid": "4fd37bec-2dd5-4292-9da1-4525bb18c1d3", "comment": "Malware payload (Mirai)", "value": "a494a750cae8ed06924a1a73206fdb916968ceddcce71ecd06b1ad98472f20c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982158, "uuid": "81c796c1-3d36-4cfe-b485-2ab575c9d904", "comment": "Malware payload (Mirai)", "value": "99ed760a0ff3f009b5cd08176b07ad470748a8d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982158, "uuid": "f5905cd4-5e63-4b57-934c-8dc76ae4fec7", "comment": "Malware payload (Mirai)", "value": "fdcdff7a98b71cc53db8ccc43863550b8f781765e71f86516f977c9e7719eabdeb60f2ebfc1f1d7c0cc0e2255870ab59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982158, "uuid": "af642f5c-c052-4449-a339-19e7c0d53ab6", "value": "T1B5C30945F8415B13C6C212B7FB4E438D7B2A17E8D3EE720399256F61378B96B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982158, "uuid": "e178a4f5-7f59-4076-8cfd-e1b6d12a402b", "value": "1536:p039BtGG8bQFPAu+64VpY9/TZxFekPKIjkz70BMlecxwywOF28QnHk3toFWKbOJD:p081UFPx4oBlxFekKH0g97FwLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982158, "uuid": "19dc8187-9f8c-4313-8dfb-308ffd9bb515", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982158, "uuid": "8b9b4c5a-f558-43f5-b5c1-4545f4c7a46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982158, "uuid": "418affe6-c564-4818-9dff-86f9e0dc18ec", "value": "concakhbtandhuy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac1aa6e-3f16-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776949932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949932, "uuid": "d773c86e-80e9-4bcd-96a0-364493dced57", "comment": "Malware payload (ConnectWise)", "value": "633257f7f3ff28f43d08862e51c51170", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949932, "uuid": "70f6fd8d-246c-410f-b93a-1188d577bb75", "comment": "Malware payload (ConnectWise)", "value": "a594109c34d1ce8b1be72b57d80bd696a7dbdf82186cb0789929a121f16db123", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949932, "uuid": "5e12fe7c-befb-4e6b-9309-7a455b2f508b", "comment": "Malware payload (ConnectWise)", "value": "fd0b3b6a2c5ef019630aacaa09975a4997cee3cf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949932, "uuid": "9f137f5d-c529-4200-9814-de5702d95162", "comment": "Malware payload (ConnectWise)", "value": "389f0739f57e2e7f3208c1b43f1cf9afeba26434c53d23800a1b0a001595c2b6ee3d5f256569560bebf1ea71a4200116", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949932, "uuid": "b46abb9e-9e3a-4be9-81ea-ead20fe6796f", "value": "T171E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949932, "uuid": "87d9cd70-53ec-42b4-992a-584ee27da715", "value": "49152:21girGLq7FVsLBe+1GVxrKlsuWGenGwfZVkVjOi8ifyXfKVzho:2Vrn/TYGVxzTGBwRVkGuyXOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776949932, "uuid": "0354d9f9-2c31-4a77-9b34-1950fa4ddb38", "value": 3183616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776949932, "uuid": "75534a70-53dc-4c6c-bcad-b405da66d569", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949932, "uuid": "34a55ccf-e030-43e1-a5b8-97f71769ee9f", "value": "app.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb1ab49-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935145, "uuid": "6a68750c-957e-4630-9999-cdd1c5c2e357", "comment": "Malware payload", "value": "33dad36c9aae34034a2e5f77848e5d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935145, "uuid": "9b7a811b-275c-4ec5-82ae-f54acdc9fe92", "comment": "Malware payload", "value": "a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935145, "uuid": "42dec713-228b-4ebd-8be3-f747a964ae3c", "comment": "Malware payload", "value": "521f0095955693705a9055ebc86ce8cf980b1153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935145, "uuid": "eb129820-aef5-4529-a878-9b7d6c1d2ca7", "comment": "Malware payload", "value": "c93b53b8f79f2d9eb5ae7211a5c46388afdb5beb16ee9e0021062b9e0999d43b110c728052a4ff0b7e56bfa739442092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935145, "uuid": "5fcc45a3-eed3-40f3-adfb-e2a61a1ca54c", "value": "T1F452DD126B11F46BC29407BD69C3C407BFF4D025BAD6D92B7A72A26D4EB1B017C61A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935145, "uuid": "9db43197-8082-4fdc-b670-4344b506b73d", "value": "48:iRnjhMNNFp1bxiLyCuKDJuFp1bJS53b/V803pHi9nBXuFp1bid0Jd/:2noNF1uJuFY53bd803pW1uFC0b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935145, "uuid": "48ea0e2e-22ed-40b6-ac82-9ea349356d6d", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935145, "uuid": "b090388f-28c6-4055-846d-8a6342e054da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935145, "uuid": "fdf7a1b1-d041-4380-8f7a-522ec774fd3c", "value": "a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a4cc8e-3f3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776967823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967823, "uuid": "67755cd5-260b-4b6a-86ac-1a3fec2ddaa1", "comment": "Malware payload (Mirai)", "value": "a768a6a9f31fa8beb77855b596662e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967823, "uuid": "270d12d2-4b21-44a5-b8ab-04ee385c87b1", "comment": "Malware payload (Mirai)", "value": "a653f33832e666b23837da088964d22898ef600cd2ef2a2dcc80c7e6531ee36e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967823, "uuid": "b1e9fddb-c69d-414f-9c0b-b7aab91b54ab", "comment": "Malware payload (Mirai)", "value": "d40bd6d192f89b7deaa8977e2fb3e3b4cc8b8645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967823, "uuid": "c354beec-dac8-4956-a785-0fca2330f133", "comment": "Malware payload (Mirai)", "value": "34da65847bd9ee59f6a3d8cac4a8bf4a66a393a6926d6780306b6c426fc76441930aea8c8a47d419503b8d566288d9ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967823, "uuid": "c07773a0-52fd-4196-810a-aaccd90b0c85", "value": "T1E49312720398A07BDF392E31EF2172E771AD581C11C66C2A522DD22ECE05AC3F1F6569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967823, "uuid": "760c57e4-d8cf-45ed-a7a3-332e6f51d00b", "value": "1536:eL7o/pN76DLC5g32eGAa0cikPNECb4JgACrbyhA6QNryXR8bfJ2kccPkn4uB1Ar7:oUN76WglGCRkryiNieDk4MOrnak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967823, "uuid": "f2a6c393-9141-40e0-8910-0c2d64cce732", "value": 90928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967823, "uuid": "a59397e6-421f-451d-9cc6-8b33a6ab5581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967823, "uuid": "bcc7b0c8-43dc-43f7-bf2c-7117e55529f0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a443e45-3f35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776963434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963434, "uuid": "37c08a8b-10af-4c2d-93c1-2e16b9750573", "comment": "Malware payload (Mirai)", "value": "134291d2fba5958b7c8c4f8fbb08a708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963434, "uuid": "b14993bb-5a10-453d-a1dd-ce1e933334a0", "comment": "Malware payload (Mirai)", "value": "a6626bb435e68780973dd4a50adeef84af904a96be2b3e423c3b75c15821b499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963434, "uuid": "baef2d37-32ca-49b8-8958-7af65231a3c6", "comment": "Malware payload (Mirai)", "value": "3c489fa9fb472b6511234b1f204834637f4bfb93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963434, "uuid": "b1f78aab-fc6d-43e7-a7b2-fce48b276ac4", "comment": "Malware payload (Mirai)", "value": "3de498e3c0a1ccbf3a0e3acf78016fb66fe19569e7b5e129011aba6a3b16685b18feb801964da0caf33a1fd86ef4ce26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963434, "uuid": "ce4e48a9-a0cd-4097-a447-a648ed0aeb3a", "value": "T12B731956B8818A12D5D502BAFE1E118E33131B7CE3DEB3129D206F24778B96F0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963434, "uuid": "674eca32-c58b-401e-a6b7-d696033f12be", "value": "1536:RNnxyKCJqGVmGsVFyEbZAfiQaaTtc8mIYiXNxNoqC7fw3W5/Y0:9qoGgGsyEbZA6QaWvNXoqC7fwG9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963434, "uuid": "bd5cacce-e0b7-4db2-bf3b-ac3893f1ab10", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963434, "uuid": "cc24c31f-736e-4c0f-b79b-ddb53da3605d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963434, "uuid": "dc12adf7-fff3-4594-9d6b-1c0f9a3bf6e4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6f68dc-3f6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776986228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986228, "uuid": "6f095b0c-468f-4714-b9a8-0f6dbfcd2f3a", "comment": "Malware payload", "value": "6a8318f242ad71191f86c2d86adcd460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986228, "uuid": "7f026c21-7e71-437c-a3bf-f0b36e75ed0c", "comment": "Malware payload", "value": "a665475e8eca412c871fa902eb81e6a941eda9ed6bd707a68d3c413a8a6388c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986228, "uuid": "3f396bfa-803b-490c-bb3d-78738f3cce2d", "comment": "Malware payload", "value": "0b67b45b2a93bdc1665de4b31d20e40355040d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986228, "uuid": "cd4b4f40-529d-41b3-bd82-4e328dcd577c", "comment": "Malware payload", "value": "46d0f168768e1f5131dae29a0ebcd209cb8bedd4309bf4004258a490439ca394ae8698e8ab33c1f70f4a3a8537208f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986228, "uuid": "d0b599a1-94d6-4fd0-8cbc-20d7ff8bbeba", "value": "T1C3457E62FB93A0B2E8CA01F213BA7FF69D685615432D44D7E2C01DA55D205D33A3FE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986228, "uuid": "3e079ade-c918-46cc-9e79-9641a645593d", "value": "c6ee283ebc25d221c2936eca37736f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986228, "uuid": "5924448c-715c-4fcc-904a-5f79c528c473", "value": "24576:/92vUazAqGCs89OijV7Jv5ZBzn8fzuTXDZjQ+GsF:F2cVqtpIi7FU+lF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776986228, "uuid": "93c7134a-9db9-4302-8fa3-922ab301fc1a", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776986228, "uuid": "45d02da2-6d41-4b32-88a0-251df9dfad21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986228, "uuid": "b6034564-7494-46ec-b540-2d682f586c37", "value": "termsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e3fcd6-3f3f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776967809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967809, "uuid": "06a126f6-794c-41ef-84ac-6c0cd7ff378f", "comment": "Malware payload", "value": "212b057e908b05614ecfc44f5aaf54cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967809, "uuid": "dad0c45b-6232-4515-9e67-65c1265269cf", "comment": "Malware payload", "value": "a6ab724fa2c18233e56a2ba8d971d811da5a0ce1b621c69ba8ad31b81847f8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967809, "uuid": "4831b71d-bf8c-468a-a7ce-9938f51b6e9b", "comment": "Malware payload", "value": "6302626fc9b832b2ec03ade96fa2cf236aa46b1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967809, "uuid": "c4f5bdf9-33f5-4760-9a9b-3115fc5c3662", "comment": "Malware payload", "value": "6540fcb5f1fbe0617c6c55c0d90f9ac0d15011cff442da32055861c747979b311b36907d0fd3301b562deeae48d8a80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967809, "uuid": "9ac06da9-f13a-4208-abbb-1fbbde48b49a", "value": "T16443F24BDAA94750E047087134EE3D2B90B0962B81D992E6BCB57AD78D50F3376ACFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967809, "uuid": "ea35a2c8-eadc-47bf-8d21-921ecdb2523e", "value": "1536:+nK4Tkanr3Fcr5OrHI3wgVPzum3GcMXpJlgnouy8Nqa3:Mxr3Flww0ymcpJCoutga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967809, "uuid": "fc9082f0-7936-4fd4-9f88-9a51d79eaa0a", "value": 57472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967809, "uuid": "991e5bf8-6ab0-420a-a3ab-89c633219d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967809, "uuid": "30bb0057-d442-4bf6-9877-3d96ddf5dfd5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fe3ef1-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776934971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934971, "uuid": "d6c0d5b0-dee7-4e6c-bacb-1991a4bec94a", "comment": "Malware payload (AgentTesla)", "value": "9147b86f0671c0a3b4dc04a6333e5fec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934971, "uuid": "dabfb716-e5bc-47c5-acbb-6ed8539ed96e", "comment": "Malware payload (AgentTesla)", "value": "a6c0c5992c8ba3f6f8e7f4984c65fe4bd122f8de02d5ee3872ff653a257cde59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934971, "uuid": "6d5d8b9c-9102-4e1c-959a-c30dcd953a2e", "comment": "Malware payload (AgentTesla)", "value": "d26b70ed1d0296e8703f02d4c8093b4e5439c883", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934971, "uuid": "92f9b002-dccb-44a3-9f94-f165526e6d86", "comment": "Malware payload (AgentTesla)", "value": "879462162ef1bf6cb6aacb8bf8cf17d45201d3d9b86972a7c3c95cf239865cba36c517444d6d9e288703937528945f89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934971, "uuid": "a9a65b75-02e9-4160-90ba-0d14195aa405", "value": "T18D84BB24ABFA1019F1F3DF54AEF46492997FBF232A0AC85D1091034E4632A45EDA573F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934971, "uuid": "c210e385-b10c-4254-aa1d-9e83e3f1a39d", "value": "12288:sW1f7WMg1+dD792Fr5d8TPX+k/CM9SXER77WhkTj:fg0dP93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934971, "uuid": "fd8b6ddf-9fff-4004-9942-984649dbec0d", "value": 400874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934971, "uuid": "2417d10f-442a-46a8-aaf1-cb85152e01ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934971, "uuid": "2622f0ca-12e0-43fc-beca-518896e9cc10", "value": "SOA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ed0637-3f15-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776949659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949659, "uuid": "0e80421a-029d-45de-bd35-b92ff1408f2c", "comment": "Malware payload (njrat)", "value": "767f5981ed7e3c443442528d48090dd9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949659, "uuid": "05d03727-f61d-403a-b0b2-ac3d10949e69", "comment": "Malware payload (njrat)", "value": "a7dfe696c8c5b2c0fe8ac4d525e0fe13173af727204a0727a4014199c64bab11", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949659, "uuid": "dfe121b6-e04e-4181-a4cd-bc490efc9ce7", "comment": "Malware payload (njrat)", "value": "100b1f4964a13a81ec26b63b5a83a4860d490e50", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949659, "uuid": "d62b46b1-b46e-49b7-9c22-07d7fe25d463", "comment": "Malware payload (njrat)", "value": "1cc39d4ac016bc4fb2d3dbf834f4962e0f610f6c94b5c6c93333db014e17a43e08cc682004798ecf9da4fb03b867f0ba", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949659, "uuid": "1c64d445-81a7-49eb-8e49-4cb421b8e6f0", "value": "T15475330953046951F1902E3CB18FD3E1F770CDA145969ACD859B71CC3AF63C6D2AE2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949659, "uuid": "e3492116-84d7-447a-a2f2-f1a4883c226a", "value": "24576:XDgBqMaEo+DUsEwzp04yw+slh0or/fblitr6QQaqbt1Cwam1LdnXx:MyEFhH8slVQ9Gfkm1RnXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776949659, "uuid": "7bad09f9-f9f1-4b97-95a0-c3e2350b0268", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776949659, "uuid": "9659be62-f43c-4f14-af86-e245e2072f12", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949659, "uuid": "03b14e3a-6170-43b7-b25e-c67545e29e9c", "value": "Tms_Setup__V5.4.14731.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54776036-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928152, "uuid": "f10e45cd-b5f5-46b8-9489-ce12e6827f40", "comment": "Malware payload", "value": "a631dc89199eae150f87eb78be63dbfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928152, "uuid": "e76cf859-fb03-4698-84cf-e885c2293e36", "comment": "Malware payload", "value": "a80484817e716f7a0d0903879ce5d79be111c60fbe67da262308140a58a54112", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928152, "uuid": "67fc722c-62db-4565-868d-9b789e4a2a82", "comment": "Malware payload", "value": "d86436aeccfc38b2f93be73ca03944e03cf02210", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928152, "uuid": "128ecb50-f624-4dc4-9415-9e33e56a7aab", "comment": "Malware payload", "value": "352820bc587f7a49e74aeea8bf0462b8533edae0e58db75927cca7a07e6cbd2dae8c4b5cc255833d229fbfd8f9ffd123", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928152, "uuid": "5f0e04b0-774b-42ab-a285-42f93b8e7456", "value": "T1ED272356AE3ADD9D00B832D221D1CA2F2DF1985588980FF4B7E33A118D7D8650CDE7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928152, "uuid": "16246f49-ecb3-4c98-9bfe-01b955df10fe", "value": "49152:Uuhi7dDQXUSlTl0SStG0lB0tEnf0D98RzmiJlSl19jLl4RxVZMVOwm67iK7Q7Mxo:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928152, "uuid": "36a34525-dc21-4b4b-9d31-f6818ab504fe", "value": 22091538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928152, "uuid": "aaf7d017-d375-4952-be6a-d3331b70082f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928152, "uuid": "05327dec-668c-4510-bfbb-249c0bdeed4f", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54bfe0-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1776954039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954039, "uuid": "067f297a-bbe7-48d1-89fd-05b7b731451a", "comment": "Malware payload (DattoRMM)", "value": "b97c5ac5a83a397839890d6f4a3a4812", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954039, "uuid": "dd436e88-ccd6-43e1-9026-fdabd62ab86f", "comment": "Malware payload (DattoRMM)", "value": "a8b67880b8391f3c07a0e8c15d023ce51164a953c66d1b56c0d780f26311030a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954039, "uuid": "e37da3f3-9551-4d47-bd1d-32dbfbaf84c2", "comment": "Malware payload (DattoRMM)", "value": "43d50a974d596fa0066cba71dec40c7d46038df1", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954039, "uuid": "243b6754-4f46-4add-a03c-bc6e5237f698", "comment": "Malware payload (DattoRMM)", "value": "ac3b41047dcb8cc5efa530835b15f5df09fb25f0f70a4ff01988290c3b2d69059776e29287b591c0120f491369e76036", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954039, "uuid": "1ffa5400-36ab-428b-9a05-dca79097b456", "value": "T1DFB63347DE3B8EF4CB63463C89831A57124F598D8C47E4C9F0082A3589E399ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954039, "uuid": "2ca892c3-5f26-4f8e-9549-dfb0e6197a3d", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954039, "uuid": "4c3bba55-8a82-425f-85fd-7dce1502caf7", "value": "196608:/aZk+wpbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzD7:3nlnkGkx08rtE7AnMGp29qIT0Wzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954039, "uuid": "0df3e7b9-37f6-435f-97ac-0d2dd537a395", "value": 11055520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954039, "uuid": "897328f2-6ec6-4217-9ccd-a64bec8b2301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954039, "uuid": "f72181b7-212f-4211-b09a-3b8075433413", "value": "inv0026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13039ea8-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944363, "uuid": "344665ca-e518-4c5b-ac2f-6df55e8b8165", "comment": "Malware payload", "value": "d246dfa9e274c644c5a9862350641bac", "object_relation": "md5", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944363, "uuid": "e4592306-0598-4531-b933-090f171ea3e7", "comment": "Malware payload", "value": "a939d1edcc422772124a373be68b7cb38110639db8b1f4b5dca0b7e94b8399e3", "object_relation": "sha256", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944363, "uuid": "7590b7e0-641b-4bcc-ad48-0d5e9f824529", "comment": "Malware payload", "value": "fa7db029079cdd5011f7f38cb25a62d2820f3986", "object_relation": "sha1", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944363, "uuid": "f5cad2ca-42a7-42af-9e0b-5fd4872ba473", "comment": "Malware payload", "value": "0ea844a57dfa2b09818b541976f5b44590b4162fd536f07fe449336344f6f415549a38400ae3eb22597ef8caf2b13091", "object_relation": "sha3-384", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944363, "uuid": "7dcca585-5db1-4f3d-9d11-b0885cb34f27", "value": "T1119633D045E4FFE377236AE0C76CF721A08F849E4BA14900F4EE9E4595279B80376AA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944363, "uuid": "c2f970d2-c737-4e93-a1f3-ecdd01bd9750", "value": "196608:exoDK6nZQ22JR5HaCplfAyyr+6x2dv75CJ6D7zwyW01L:egK6Zd2N6g6yWSFCJ6HzY0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944363, "uuid": "b956bf3f-c750-4078-b585-d5396a4d5f09", "value": 8778954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944363, "uuid": "6494a30f-5afa-499e-9fa7-cd35298f9153", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944363, "uuid": "4b06bf26-fa9f-46bb-87e6-6cdcdd7c6dfa", "value": "a939d1edcc422772124a373be68b7cb38110639db8b1f4b5dca0b7e94b8399e3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f61748-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776931000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931000, "uuid": "498319b2-4fec-459b-9137-1120a91ed03b", "comment": "Malware payload", "value": "1d28cf7c500c457f01b8508fa9fe92b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931000, "uuid": "e06676e6-7603-4ed3-8fd8-91319794abff", "comment": "Malware payload", "value": "a95375f5bdf7ddd1c4878b594b76ceaa45fb4bd9174214b8f1b67fcb879c278c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931000, "uuid": "e7fb5eb7-4ea6-47a5-a3b8-d7125d870efe", "comment": "Malware payload", "value": "a9fddbc5d062e8aa99cc8334a9a468aa6046129e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931000, "uuid": "864b0d49-9bee-429e-abcb-0749e4253e72", "comment": "Malware payload", "value": "7d5e8e3ccb72f0e8c9c1536860f2594a9dcadf8e24a2d62643096e7f77139601945a7fb73bc1e4feefcd08bd60e3787f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931000, "uuid": "d6818ba6-5754-4fc0-bb41-1f89abbf79d7", "value": "T166967D43EC9545E9C1A9A230C9BB9252BB71BC480B3263D72B50F7386F76BD06EB5350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931000, "uuid": "b60f2436-2505-4670-b231-2dc8fe23d43e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931000, "uuid": "11f35bd7-121f-4b72-8c25-8fd2a5b31dd3", "value": "98304:w9Bpt/N1f04dXrr27zSdI2EdywCGGSDybsxHqt5K2L:w9b1s4dbr2n/zowBg4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931000, "uuid": "c428b002-dd01-4269-bb87-bf606009eab5", "value": 9088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931000, "uuid": "32267c6d-91f9-48f7-b657-b70bc0a56ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931000, "uuid": "91e6c735-d1f3-4c4d-8fdc-37db32b9ab24", "value": "a95375f5bdf7ddd1c4878b594b76ceaa45fb4bd9174214b8f1b67fcb879c278c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90718a6-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776926656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926656, "uuid": "73b5be77-1dd6-4ef1-97b9-882fb564fce5", "comment": "Malware payload (GuLoader)", "value": "4c580b78bb5ef08defe3fa3cb9b57b10", "object_relation": "md5", "Tag": [ { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926656, "uuid": "407cb4a3-359c-4c9f-9eb5-458c8af025eb", "comment": "Malware payload (GuLoader)", "value": "a9b4bfd5e66c09db5ad06969b145095fc9031916b9883955a56082748d255ccb", "object_relation": "sha256", "Tag": [ { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926656, "uuid": "29888c57-76b4-4500-b2d3-2ba4db3acca2", "comment": "Malware payload (GuLoader)", "value": "395424c4ebbfd00af35d7b9f3eaa1f1cd6510d38", "object_relation": "sha1", "Tag": [ { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926656, "uuid": "1963e3b8-9ae5-4192-9b0e-ba7f8b6fa8ee", "comment": "Malware payload (GuLoader)", "value": "a89f056cbabef59af7e994b6a6c0c481d3c8833c1fc3bbd948fbe3e5e3dbf4316d962e93098f049c486d43b3771b083e", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-omamontaggi-it", "colour": "#C7C661", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926656, "uuid": "c9056b6e-af06-4c83-8a27-247d083bc31b", "value": "T1C45512E15B74FB26DA82DCB84575E7BED1FDB4007C568E027A1D2E1F8B283909D1D20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926656, "uuid": "f182e0a6-1352-449b-a078-7c741fdad175", "value": "12288:pwFGHEN1Sn2VNDyu0AP/0wGc/fMz3rzNI3ylgimtdYM3O0V7bb:p5HEN16kh01w3sZlgZtub0V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926656, "uuid": "1f09cdd3-39b4-41d8-8c86-fc4d53f9763a", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926656, "uuid": "c4607c48-5339-42da-b433-a76405f86308", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926656, "uuid": "3b689afa-9891-45d0-8b1d-5829dd3cdc3e", "value": "a9b4bfd5e66c09db5ad06969b145095fc9031916b9883955a56082748d255ccb.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cd3fee-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923060, "uuid": "9b0242e3-c9e6-45d3-852b-360bb65221d7", "comment": "Malware payload (Mirai)", "value": "affd1222f7bec68c764c8c87494ce3a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923060, "uuid": "2be5b803-7804-4b6f-be65-0bd2e5f81c3b", "comment": "Malware payload (Mirai)", "value": "a9d120626cc07051f4329a33c8f8ce14d460d687d686cdf3a5cee56be63deddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923060, "uuid": "ff23e138-754c-4195-9b31-dc03d5da646c", "comment": "Malware payload (Mirai)", "value": "c59086f79cfb43d69e3d962a92ce8fb727704457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923060, "uuid": "bfac47c6-17b5-434d-a57c-47740b0898f9", "comment": "Malware payload (Mirai)", "value": "a1049520af442a4967a425ba13721345335e759c50f6d1a634b3e06ee123238e5f3ac5d5effc0ae6f4c0957bea5af6ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923060, "uuid": "924b819f-373e-4d8e-87ed-fb315b2cd6ae", "value": "T1D0230271890E9EF125303C72EB99979376A119B1C6673013DA280A3C7FB5A131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923060, "uuid": "23b67df5-eefb-4d00-a023-388214ac0e56", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3S9q3UELbUXfi6nVMQHI4vcGpvl:DECFd+A6YHAxHLRQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923060, "uuid": "ecd83afd-33aa-41fa-bc4a-8441c22ddb0c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923060, "uuid": "053d91c3-f9ae-467f-b2a9-9a00c0e3d3cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923060, "uuid": "ae85ed12-fcb9-4d1b-9980-5f5764c88217", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9dbd67-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935121, "uuid": "244da577-3b58-49d2-b988-732530b6d84a", "comment": "Malware payload", "value": "b387d3514d6a4d105b1c1d69f166e8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935121, "uuid": "62a7611a-34e0-41a2-beaf-3acc8f0decff", "comment": "Malware payload", "value": "aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935121, "uuid": "b7e14753-6a38-4f22-aa71-8e114bb9291f", "comment": "Malware payload", "value": "c665a21a8497ceeb700a17154938b2e8d85281a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935121, "uuid": "75518f5f-d417-42b4-a609-745ad1c8450f", "comment": "Malware payload", "value": "8703affc02291bb0a4f5de8abdd22e8befbbc8a7cd8c1f6857f60ec6eccc81d010faead89aef27ec75c6b47422c41e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935121, "uuid": "d52ff004-8775-48be-847c-7cf1b306a0a6", "value": "T136812B37C3755DF6C41C017903435842155D943802F2E61E4F44202E7050B2C2DF6E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935121, "uuid": "eb9c02d7-42ef-487c-b89b-b69f7c9c026e", "value": "6:idq+Vg3F+X32pYXNN7SVYbudkj3wE6Ep:eFGSGpYXNCqj3wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935121, "uuid": "957d2fc9-8619-4f0b-b3c3-d55d7ec43efb", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935121, "uuid": "14c8b5bf-7ee9-44ea-bf19-0569ec86b762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935121, "uuid": "eca59c6f-c71b-490c-9269-d750fbe7fa98", "value": "aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73041cc-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776964422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964422, "uuid": "b5e9ceb1-aa3e-4b09-89c6-16f30d2873e4", "comment": "Malware payload", "value": "d0aa295d07819adfd8caaaac40d70afd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964422, "uuid": "98dadcd3-ebe0-4000-9239-cb2d60bca819", "comment": "Malware payload", "value": "aa7501f8b40c1b558eec80e8cb39c6c7ddf4ea49f913abd3ba6be8cab6bf09d6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964422, "uuid": "f712172c-9897-4f9c-b993-6ed2bf0ff5ad", "comment": "Malware payload", "value": "65d0d98647d41c46569845f0ee075c6eef75f371", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964422, "uuid": "4104a9af-ae1c-4c19-95c5-e7bf20beeaed", "comment": "Malware payload", "value": "b9ea906e24e1263dd165a2d28fcd762e1d8bb092f2c20b25b8b985cfe058d778488d4a501d0ecda11436e936a6e9c76f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964422, "uuid": "f4844c41-e14d-4fb5-b260-4ccdde2530fc", "value": "T141137C6566813C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964422, "uuid": "9d26c746-3d96-4365-8826-547a42f94b0f", "value": "768:biXRWNGxV29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bOlxdcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964422, "uuid": "f726026d-91b6-40b2-878e-48c9b5e4e241", "value": 45499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964422, "uuid": "9686d597-5832-4cce-9317-89f290b3f9bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964422, "uuid": "6f864219-d1e8-4122-8cf2-9ce4327632b0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d44e7fa-3f55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776976995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976995, "uuid": "66140d53-9185-440f-b6b4-2b897f90ac2a", "comment": "Malware payload", "value": "5d985940cc266350f3a451f6f93afbc7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976995, "uuid": "06be1c29-d16a-4275-85c0-afb80ecd23d3", "comment": "Malware payload", "value": "aacc8e2b38477265c25eb0432d1346a2726f41fb69ab6f2297161d0641c3c252", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976995, "uuid": "fda4f907-9ee4-4281-bac8-2c5f7adbd5a9", "comment": "Malware payload", "value": "fe00b27d47650a42a85d5daa0f0263c8e239ad54", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976995, "uuid": "0babb911-5989-4392-aee1-4758533d9ff0", "comment": "Malware payload", "value": "7d57a230bed8afc951f69cf99d4054245617ca3a044644ed909cb4777c6a4d909bab6ffefa9fc219bd63c34fab8cac98", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976995, "uuid": "8d9f33c5-50cd-460a-b9ee-ec2b47b7c934", "value": "T131A38E41F3E242F7EAF2053200A6727F973662389764E9D7C34C2D429913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976995, "uuid": "816e33f6-f40c-4eb8-8aee-75b556d311dc", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976995, "uuid": "ef9ca614-2253-411c-9059-3dca420ec78d", "value": "1536:P7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfWws6hCwzbGakgVH:j7DhdC6kzWypvaQ0FxyNTBfWbwXGakoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976995, "uuid": "27dbf0bd-d29c-4339-b486-c0479a47312d", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976995, "uuid": "c7049913-d623-47cd-b616-717655531d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976995, "uuid": "75ad0d69-cc7e-4603-9a33-732abed2fffd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bab8a54-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928566, "uuid": "04a81ffb-2a97-44fe-a3a2-8ed7f57f44a7", "comment": "Malware payload", "value": "1ac91895aa8277e876e7e775a8f4fe58", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928566, "uuid": "d51f52c8-3bc2-477a-8f3b-fb2d5616a499", "comment": "Malware payload", "value": "abeb8dea0caeb6361644fe66ee6126c0b178054708137ea8d77d930a8fe21638", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928566, "uuid": "d2fc57ad-8f72-491f-998e-b56414763a48", "comment": "Malware payload", "value": "9b5bbd4c840db05833be1b56f5ba987198322da1", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928566, "uuid": "a7825962-5e2a-44b2-9fd9-c299c3a00ad4", "comment": "Malware payload", "value": "91c6d0aa9e5c1528393f292913c75404bb8afca547fbc065950f9eb90538c2384dba4a48421126764a6027597b7e9579", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928566, "uuid": "79cd3d94-3c53-4d94-a3ae-13d81f51bb09", "value": "T1E9D3C8DB89CF88EC835FA068051F9C02CA8F5117955DC5A07AEFFE593F25EA0B1A58C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928566, "uuid": "23d91353-a729-4eae-bafa-b4ef2cfcdc1a", "value": "1536:qqhTpsKZ2zqNIQWqRLuSk3MeJ9WGyVUBqX0z6u7tvL1:qqQKZrBiaiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928566, "uuid": "33bd0918-201b-43f0-87a9-a071d6e93d3d", "value": 139354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928566, "uuid": "42d758b6-eb5e-4322-94f3-026dbf0beb01", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928566, "uuid": "07897af4-f137-4ea1-8440-aa161b4a894f", "value": "Delta_Data_USA_1579.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14e88f1-3f44-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1776970022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970022, "uuid": "c28d974b-88ad-4601-a0a8-8b95554e21f4", "comment": "Malware payload (BlankGrabber)", "value": "e8198192ac0c7fbb97eaf4e096afe978", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970022, "uuid": "86fe8059-c0a8-4538-9535-6e6b38f81b8d", "comment": "Malware payload (BlankGrabber)", "value": "ac0ab9e82b90540f095fdbb7ac351f84fdd1f1ffda5521de3633ffe9f36030b3", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970022, "uuid": "1a53afd5-b72c-4360-b1a2-0e8d167cf780", "comment": "Malware payload (BlankGrabber)", "value": "90b0bfb9c1ee5e2c518b30ecde3fc15a9a5f5218", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776970022, "uuid": "93be118a-d388-4627-aff8-79293f3a917f", "comment": "Malware payload (BlankGrabber)", "value": "0b2ce3253f45eec691d5b8bc419f3ac40a4d9e2e0643f4d51093ecbbba5324dc74e47206da92d1bd909dae2640c13258", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970022, "uuid": "8c939c65-1e98-48ce-a046-3f89a941eb31", "value": "T1E4963301A68008EAF7BBD93D98A6D519C473369217A0DAFB071CC27A0D731FA5C76763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970022, "uuid": "4dd07b2d-7631-478f-a38a-b9364caead71", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970022, "uuid": "7de19872-81fa-49c9-bd99-815ea18e1cd0", "value": "196608:GZuCoYVwfI9jUCzi4H1qSiXLGVi7DMgpZkrl7Q0VMwICEc/jk:fFIHziK1piXLGVE4UqC0VJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776970022, "uuid": "b50117b6-c1e8-4847-8a2b-a09b63488e41", "value": 8752489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776970022, "uuid": "921660cf-6254-4a1b-856b-43b927673dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776970022, "uuid": "97bfb842-d212-46f7-b547-246b6a1381a5", "value": "Cs2.Mod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f552dc0-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976166, "uuid": "2542fc50-72b8-4d80-be51-1a2f59e04120", "comment": "Malware payload (Mirai)", "value": "34ecda76ebdd3a63b06db5058a423e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976166, "uuid": "6fa3742a-a91f-491e-98e6-23f68b260a69", "comment": "Malware payload (Mirai)", "value": "ac7c7a1a47ebd926b4d6ee498d2b1c7a22efc1a9b08e62d4c4fd77c52f2e960f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976166, "uuid": "da7adc7c-8c08-4077-aebf-fa5b19c4fca5", "comment": "Malware payload (Mirai)", "value": "10316f367b440ffda830ca2221c18bf5bc6d6da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976166, "uuid": "a40a61d2-344d-42bf-bf57-a118b12ad7cb", "comment": "Malware payload (Mirai)", "value": "a1f8abf5822e26dec7e6552483baed271b5e24636b72287192d757e4447a0f4706222803e438a13f08808e4dbf60d6db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976166, "uuid": "07652191-6adb-4219-982e-22b1eb918bca", "value": "T12B438EB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976166, "uuid": "c58812a8-b6da-4e54-86fd-64f56d005186", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfPA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQD8A1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976166, "uuid": "40c3947b-510b-4ca5-bbbe-1df8fd612692", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976166, "uuid": "3f9d4d50-6b5e-406c-98d4-d6dc1867425e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976166, "uuid": "9ac2c628-5946-4f59-b7cc-9c3ecd9bf28f", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038aa089-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928016, "uuid": "e80b3663-5a94-48dc-b0db-c19e981029e9", "comment": "Malware payload", "value": "073a7a5c887559310e4d49aa25991514", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928016, "uuid": "0e000d63-d7dc-467c-9bb5-c6c133f8b4ce", "comment": "Malware payload", "value": "ac8ca36c4969d6f227ddc9500b56e3d9456baa443ceefa7365d601335655a724", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928016, "uuid": "a287c86c-8242-47e6-a75f-468e34ee4352", "comment": "Malware payload", "value": "f87c9ccd3af52e68163b715a0b1465b3758ce03d", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928016, "uuid": "c6c2141a-004a-4c12-b111-b6eca06641ef", "comment": "Malware payload", "value": "7a516c205fda4652c7d4aece54a50ad408517ee411f790915c95cdc31c74b2b67615fa5de1691c836bbfa61c7c3e17e1", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928016, "uuid": "18499f86-3087-42f3-9b84-7f651c1348e9", "value": "T1072723444F1CDF6F81C83A3E48CB5A0E51934631447AC6FE1E723ACF2E0E9A15BA7659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928016, "uuid": "708896e0-299c-4eac-a8b8-4e70b45b1175", "value": "49152:uKtoKtvKt/KtTKtUKtuKtIKtUKtpKtmKtqKtNojKtjKthKtoKtXKtmo2KtcKtoK7:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928016, "uuid": "280af152-7826-4e32-b0f2-f2b73c303f39", "value": 21371515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928016, "uuid": "67d223c5-c765-4054-970a-a7ac95a5e7c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928016, "uuid": "70a9bc17-441d-457e-84f5-f4329b79b99d", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba38eb5-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972375, "uuid": "da9d440f-d6dd-4a85-8987-819bff0b6100", "comment": "Malware payload (Mirai)", "value": "a4e0581847f62d5621661a04d4361e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972375, "uuid": "17cfd2ce-3fcd-4706-8a6f-1675424ce5d8", "comment": "Malware payload (Mirai)", "value": "ad34a3f4429f174c1e1510e9164513a0991ce7bcffef174c70fb3e6cdaea2562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972375, "uuid": "0cd26a60-e5ae-41a8-9bd9-bdcf51775dd0", "comment": "Malware payload (Mirai)", "value": "7c08d099dd82bec6df93c462ebcb5acbf6b8e4f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972375, "uuid": "43507bb6-91f9-4641-9829-a254af749f3b", "comment": "Malware payload (Mirai)", "value": "4e0d68848d0a1123d1ebe73a4ed99eca655cb6d8bb0b6aa2e98ca61a0cfe6099549b15b1a6007f93dfb60d7271f4ab40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972375, "uuid": "0f762a86-b749-4114-9a99-19268a6a038b", "value": "T174E37C72C869AE99C124D471F031EB346B439E4645871FBA2EA7CB754047CCDFA0A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972375, "uuid": "cecd6e95-d2a7-441d-a53e-5a9365c9e6fe", "value": "3072:37nee0PIdhhC29VePp4eMFiR34+kUbmdBKuWhJ9h6XpD:3ydPyeBR344bv7hb8XpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972375, "uuid": "6f0f79c7-cbb1-415f-bb4a-8b0f56b6d28a", "value": 146084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972375, "uuid": "47ace39a-29a8-445a-9a01-a8b707ab9a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972375, "uuid": "b357cc9c-4a95-4d6e-98a6-475b35aa3791", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea88696-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927900, "uuid": "e90efe14-1536-4abf-8010-1982e2c04343", "comment": "Malware payload", "value": "0e5f1d42aeedd2592176d3856916a64e", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927900, "uuid": "fa4b25d8-4344-4fe3-8db8-8ee7b38f1e27", "comment": "Malware payload", "value": "ad690571a3f29c418cb3897bc9601553e23d40e7e6e9020f211bcb376bf4d17a", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927900, "uuid": "b4b70ce2-baa8-459a-8cb8-81c0c1c7e6ec", "comment": "Malware payload", "value": "894c7bc35156ff112f2e5e11b6f64c87201332e8", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927900, "uuid": "671365f5-f5e7-47e4-b334-68a46b84540d", "comment": "Malware payload", "value": "0977671a44dda858c28bffbc4204bf9b06565636b182e48deb461534ffaf666f63e15c9cf06a642fb512ccdb45433312", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927900, "uuid": "e8835d93-094a-4252-a741-37cfaa10eddf", "value": "T120272207AEF4972FC9040E48E4B7168A36F44AEE985CDB00A7F6A4D8358F716157F1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927900, "uuid": "69619622-7efc-4ec1-9d0e-9ff328574a33", "value": "49152:ScDOicDOtcDOTcDOXcDOScDOEcDOzcDOScDOxcDOJcDOYcDO+AikWcDOIcDOscDU:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927900, "uuid": "601d9842-6c54-43eb-890b-b56942fb5ab0", "value": 21371504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927900, "uuid": "e93c5a43-b7fd-4c31-b586-0f82779c57ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927900, "uuid": "367a90b1-c8f9-4a40-a398-999c30e8fa4e", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c65be8f-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776931145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931145, "uuid": "48c37a42-2147-416b-b9b7-71ef852e4fb6", "comment": "Malware payload (Mirai)", "value": "26cce6755c692ea424f5f6a59ae800f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931145, "uuid": "7e3426ef-4efd-4382-9702-063f08694668", "comment": "Malware payload (Mirai)", "value": "ae010c2695c0628c7110054be30d17aa26ef24a82f58aa26e900ed5f87dbd968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931145, "uuid": "54c63348-c6b5-4b06-b034-4ba089a98e3b", "comment": "Malware payload (Mirai)", "value": "0c476af53bee84e170fea5965b56428a6a126eb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931145, "uuid": "ee001886-106c-49d5-8b76-33fde51d55c5", "comment": "Malware payload (Mirai)", "value": "1794cfe467c1985fbe59957c648e1a63312e0a02502888064bec56b5b704789f185fb7d5e6072eb159d59f22fcef5cf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931145, "uuid": "eeb3cfaa-17b0-44ad-892b-724d9965959a", "value": "T1F682DF3061AB34E5DBF10431EAAECEC697560BBCD0FC36A31759AF78894250611F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931145, "uuid": "40230742-68ff-4093-a183-e4bcd763d91b", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMawhymdGUop5h5l9:2dV0P6+kom0tVAoNvm+to1ws3Uoznl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931145, "uuid": "7555b6d3-5075-4ef0-88a7-668526d8732d", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931145, "uuid": "9ba44c7a-1c48-4ba6-a24a-6461c75b05f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931145, "uuid": "5a366070-6b57-4444-9169-efc562708b98", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbd0ebd-3efb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938339, "uuid": "deb817c8-22eb-45f1-8629-25458b77d994", "comment": "Malware payload", "value": "76d1df69cc808b124ddff67e3cecf955", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938339, "uuid": "d46307f7-d12e-41bd-acb6-4f4ccc3dff49", "comment": "Malware payload", "value": "ae282788da36b97fde6e1ea9a6492072e90145a81dbc7fa5ce3f90349bb25a3d", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938339, "uuid": "90e501d7-b6fa-4964-a3d8-0d529c562e41", "comment": "Malware payload", "value": "35f40aebb4ed7bd59529ceeba202f759d482997c", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938339, "uuid": "2aa11892-ea4a-4aa0-8eee-640727fb6c9f", "comment": "Malware payload", "value": "8131d0dc16544c9ae12163943bef7b86c12fbf5ffa286a2f2ea0ef76e25f90b27f2b7ed85cb9c2e22aef5a8b786ff2fd", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938339, "uuid": "f495c39b-77ec-40fc-a014-9c4d7c2774b3", "value": "T18EF02BB75841002794CFC1AFEA31A005B261FAEECA063D0EBED9FD3435451B1B162D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938339, "uuid": "b236da71-79ca-46a2-82ca-0285fe204668", "value": "12:2gDlDzBNKzdN8Q5NmfH0QwhGyCycwhGrPW:2gDl3KhRrmfUHh1CahkPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938339, "uuid": "3ca6fbde-862c-4f48-b8d7-733789fca912", "value": 536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938339, "uuid": "720df3b7-73cc-44ac-af6f-b929f2bf2b76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938339, "uuid": "765295e6-7e0b-4002-8997-a809195510fe", "value": "ae282788da36b97fde6e1ea9a6492072e90145a81dbc7fa5ce3f90349bb25a3d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f061be-3f14-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776949221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949221, "uuid": "5cc2198e-4482-451f-bfb5-8297385dc7be", "comment": "Malware payload (DonutLoader)", "value": "da1adeae4d3265bcebd0b485cfdec05e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949221, "uuid": "009db914-e131-44da-b670-33d98d2e4ede", "comment": "Malware payload (DonutLoader)", "value": "ae4506ade7e693e10580570cd6a6835138ebc99a9a1aaad36c19aad2a18d5dc0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949221, "uuid": "752a386f-5aa2-4066-99e0-b1b64cf75e56", "comment": "Malware payload (DonutLoader)", "value": "5535fb4cb1f34eb8850ed61db8b3394fa4e3eada", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949221, "uuid": "2326faa7-9c89-4cb9-9d39-fc18388e27ee", "comment": "Malware payload (DonutLoader)", "value": "ca8f634723a23709371fea47a0476198de2415dc66c62734a133e1dc42b3d1d1323e7f18dae620c32f6a9c13546339c4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949221, "uuid": "8702a871-6066-48a5-9138-9171b70b9739", "value": "T1FBE423A307C31CE729E7CD2EE13BA159A39DE2F24FECD18A6195B548100CA079B5FD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949221, "uuid": "746db54b-82ef-4554-9e4d-ddb0a52ed2fa", "value": "12288:4RQHHBJmXAtFHY01Xae57O7HYpYlInpp8+nGx+clh72/EQteiueDZOuNgStsOpe:48J1T7O7MHWx+cls9tekDZOuNBPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776949221, "uuid": "06e9bd9c-c355-4206-89b9-ecbe9aa54ce2", "value": 707593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776949221, "uuid": "228a165d-829a-4f27-a67e-00a5b531446b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949221, "uuid": "65d99431-b139-451d-9e00-f0f856eaebae", "value": "rFedexShippingDocument.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531c849f-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934162, "uuid": "85b95091-defc-41b3-9c6b-e9832ec5d74a", "comment": "Malware payload", "value": "a7ab9d4d174a2dece66c67a9a832ad22", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934162, "uuid": "ec87ba99-9c27-434a-83ff-89aa569d0b68", "comment": "Malware payload", "value": "ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934162, "uuid": "6b771c10-048a-4501-80d7-d9ea8096f0a4", "comment": "Malware payload", "value": "ed40a4543c6df04e3de2007b52fef4b6029a1032", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934162, "uuid": "4d048ebf-c2a9-4752-9040-7c079dc09239", "comment": "Malware payload", "value": "660ead333ca590eb01d9feb7a6741755bbfa96893653ba2fb3620b9877bb5a606aaefa7a83cba7a3f010ef5ceb439149", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934162, "uuid": "35b65e85-41a9-4ab8-a876-12cde34dfa1a", "value": "T1D4826C78B912AEFB9BBC705344C6822C95387938E9943DF26CD318A6180E77514B7EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934162, "uuid": "a8937982-fb0d-4373-8071-060b594fb277", "value": "384:ZdbGV2Q6fwyseq4pnO2DLHonRMJ6lrOgEih4c407ZKvTrlD7DG9UcEMEywmxEYYq:XGl6IysicSJ6Z1EI4cjEtMi0a+H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934162, "uuid": "508d055d-0b62-4f62-9e91-1b3f00a5634e", "value": 19292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934162, "uuid": "bdafbc53-c1d7-4abd-b3c4-2eaebc9199de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934162, "uuid": "9d0c0b48-eb8a-4b32-ba06-39b78afd2646", "value": "ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66d9292-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934302, "uuid": "e65a0e15-4a4d-4578-a2bc-df6ca01c9222", "comment": "Malware payload", "value": "a7eae5249c0930664bbf2aceaf2a9b08", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934302, "uuid": "b51c0e3d-66e6-47fb-b07c-4c0bcb99f742", "comment": "Malware payload", "value": "ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934302, "uuid": "abe948ff-8ef4-4ca0-8909-449c039e28a3", "comment": "Malware payload", "value": "88969a3b5b312cbc9e436169a9086fc4eafe3464", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934302, "uuid": "e37be72e-e536-47cc-a13b-63c2e034cbae", "comment": "Malware payload", "value": "439f3cef66e913b31710d6e66a13fb7e7848a94e6bf567733cca32df69b88c330d5456b63cd1bd6521f3dbea34153b73", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934302, "uuid": "63bb6813-2cbe-4b40-a539-2a372736e09a", "value": "T1C612193036429EFB0F9A10C1049A893CD62879F4D824AD994ED76F625C0D72712FBFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934302, "uuid": "db00f80f-1049-46d2-9b19-58e436c5d5b9", "value": "192:blhyuaU++yCMjz+KskUWgLcKbXTWnqTqZPRkYvHVRS+NaWNH9FD2zu:blhFaUmj9LKbXK5ck1RS+o67qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934302, "uuid": "53579afe-8a92-4e71-9705-da531da3b4a4", "value": 9808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934302, "uuid": "a2d90a0d-a0ee-43f6-bf7e-086330873d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934302, "uuid": "054d0316-ad48-42c8-ba4b-7529dfcc02de", "value": "ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7ebcff-3ec4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776914956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776914956, "uuid": "15b2f246-6c96-433d-8454-7816bdbcc596", "comment": "Malware payload (ValleyRAT)", "value": "990ed1c2ad2fcce293f38c5acb80d6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776914956, "uuid": "a8832909-6a52-43e4-8015-61503a3f8df4", "comment": "Malware payload (ValleyRAT)", "value": "af9299d62b91dad8c048aff657e9a1a81b7bff937f17151b89ad1c893a31bb07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776914956, "uuid": "3420a6e1-199d-4f12-a80c-76fb11428bfb", "comment": "Malware payload (ValleyRAT)", "value": "88c9b88eb8a8af5719e6ffb68872ef58f71895f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776914956, "uuid": "29b04ec2-1603-494a-a024-ebab45b0deb9", "comment": "Malware payload (ValleyRAT)", "value": "e9cc12fdea0c46d70c88fe578346a14fb4f15c842f695f054cc9210b37619b0be379fecee5dceeb86a92db20045e693b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776914956, "uuid": "52451923-100a-4ff9-b6df-093d69681d10", "value": "T19D34AE43F2E2FE77D26500350F7A5A685BFDFD280D325B872B1AB70D2938650742AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776914956, "uuid": "92eb78f3-0f51-4c85-b3f8-b3efaee384d2", "value": "1688a7bbed5105b7d1b3cc331e09a6e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776914956, "uuid": "f0144733-8ca6-4db9-8fe9-c84245ef6338", "value": "3072:LnZ18p2rZRG+z8b9mawopsHgotDPFO2r0+fAeVywqVi21XxJJ8TSJNlIcjI:LD8QooaSHxP/xtywqHbKSJXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776914956, "uuid": "8e797abb-9988-4c45-a1d9-c12dbf5a5bc2", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776914956, "uuid": "7f737964-2bfc-4d1f-afa2-37c86f4d7d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776914956, "uuid": "475cc9aa-3a50-439c-ae28-919f8f03bef3", "value": "\u3010\u5d07\u62dc\u5927\u6d0b\u5c4c\u3011\u4e2d\u56fd\u7559\u5b66\u751f\u79bb\u5f00\u4e2d\u56fd\u5c31\u662f\u4e3a\u4e86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb77fbf-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776954123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954123, "uuid": "6a0e562a-7d74-4e78-b458-443752f13bfe", "comment": "Malware payload (ConnectWise)", "value": "3b0fc2909bd863c2df1548b82ed3d7ab", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954123, "uuid": "2e5469f4-ec43-48c4-89e1-88c3c2ead6a2", "comment": "Malware payload (ConnectWise)", "value": "b014212dad9301369b09c11e2ca06279b23a764a183e0958b802b2d92cc0038f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954123, "uuid": "22cc04ed-c54c-4b2e-adf8-d9129710d65f", "comment": "Malware payload (ConnectWise)", "value": "737fcbc7d2dd05ed66caa7f1afddfa24d7701ad1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954123, "uuid": "e18d1b5f-88ff-4150-8d71-3376397af0da", "comment": "Malware payload (ConnectWise)", "value": "4e4e833357ff58e59e22513bdb61a2c241c169ab24dc06aebaa449cb678350619d23e6510c343cfe71124a72d3de2167", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954123, "uuid": "e7f68da4-e177-42e7-be9f-1e939c06637d", "value": "T13ED61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954123, "uuid": "c5c23ee6-e4fc-4251-a5b1-787f6a74a1c3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954123, "uuid": "c6a1de31-4bf4-4d17-b85e-91641424548b", "value": "393216:xCXvI5MvHxpJyCXvI5MvHx6CXvI5MvHxbCXvI5MvHxd:xZ6HxGZ6Hx6Z6HxbZ6Hxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954123, "uuid": "664ca5f0-4629-4beb-99c0-73a477c057e7", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954123, "uuid": "90d7f410-226a-4d26-8428-757ecb302f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954123, "uuid": "8a898690-3cc0-4739-aa4d-971a2f4626d9", "value": "ScreenConnect.ClientSetup2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8025760-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968262, "uuid": "20e5e445-c1aa-4443-9041-7d891dd6bd58", "comment": "Malware payload", "value": "d2ecc78db5bf5bf646d552de49a286d3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968262, "uuid": "9cb24681-e4d7-4f6f-a05b-943ac97149e6", "comment": "Malware payload", "value": "b028c30f784919c53a74089b5eee6a554fb9b9c7dd914f2d0a434dd2aacf4a0a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968262, "uuid": "9133eee1-1728-4cdd-9245-51de0298d6f7", "comment": "Malware payload", "value": "053d074657d24754066db6d610cad4575ccdc726", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968262, "uuid": "48650360-c5e1-429d-9ced-f3f10e64687f", "comment": "Malware payload", "value": "22c7be2332b1b7d5dd9d1ad4f441bc43a3d5b027eb72ffec6820e4e7f81697d92d440b887ec24183569e74b00c086ae5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968262, "uuid": "18b60296-f66f-40a5-930b-12ad45d66a2a", "value": "T1159612D6F7D8A92FC4771173CDBA52F215464C128A838F536958730C28BBAD44F8ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968262, "uuid": "6fd48654-f006-4388-9ad0-e9d8d3df9f01", "value": "196608:QoLI0rkqeVzEwXFHvRDyhhxPmwlpG1rzOppILgpT3:QbswX9vFy8KpWKppIUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968262, "uuid": "420113bf-026a-4f70-953e-1656d70d1c7b", "value": 8959054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968262, "uuid": "cb0b1eb7-18f9-483f-9697-fe1e8f2e77e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968262, "uuid": "1f18b5a9-34ab-440f-9b5c-bd059cbbe2b4", "value": "b028c30f784919c53a74089b5eee6a554fb9b9c7dd914f2d0a434dd2aacf4a0a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da9c318-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923120, "uuid": "36e4716a-2537-4fa6-b399-43fdfefce7e9", "comment": "Malware payload (Mirai)", "value": "42bd4ce7cd8679a3a4776640c0605b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923120, "uuid": "eea0461a-41d5-40f1-b7f7-8988e6cd2451", "comment": "Malware payload (Mirai)", "value": "b0639df38f2df3d40f9ae6f26f564dfc69dd581a29c079ff28a0dbb6abe0233d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923120, "uuid": "ca16fff3-faa5-4263-8cd7-0a076ca8afd0", "comment": "Malware payload (Mirai)", "value": "41e944034a3e9f8e194d0265e470cd9714f00cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923120, "uuid": "36f4f6fd-1b3e-4803-b5c6-fe98df4952c6", "comment": "Malware payload (Mirai)", "value": "b8203904e84d9a45876fbc5c83144d610b7fcefc0f8f9e7f5aff940355f88a3499a09fe4393dd69995331f1ec677d2a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923120, "uuid": "9c0ecf8d-83f5-4eff-9e8c-e8093655aec5", "value": "T14F259E89D7C7D4E1F15300F5068FC7B60534A2265013FAF6EB8CAA767472B626E4722E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923120, "uuid": "113bf148-917b-409f-b7b7-bad2a1a2b79c", "value": "24576:uNUxtYja/EBxb2KYvhTbhhyNj8uDlExIalnyxPv4PX1KI1m4lsH/pRzjWk/7v:WYvhTbhqgy5alov4iRhWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923120, "uuid": "faba5f2f-7bbb-4f09-a6fa-cab29e6ad527", "value": 1025584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923120, "uuid": "20614e8c-287f-40ba-8166-a8dcd4a7da89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923120, "uuid": "9b9dfc58-5b8b-4a42-917a-11787d59daf8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d83a1d2-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1776934180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934180, "uuid": "620c7fd4-300a-4be2-bccc-f15c378f9393", "comment": "Malware payload (SimpleHelp)", "value": "13a3c6567762844803724ae3cf1c2abf", "object_relation": "md5", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934180, "uuid": "13461a01-811a-432c-9fb2-354cbf5eb557", "comment": "Malware payload (SimpleHelp)", "value": "b0caf70b59a8de975ee97cc9b230b5e61331a138b3310377f4fad8c14a556d9b", "object_relation": "sha256", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934180, "uuid": "e74f4f07-40b6-475b-8d05-dbbecc6bf649", "comment": "Malware payload (SimpleHelp)", "value": "5cd497d5560779582a833071e89de9da8715fa2b", "object_relation": "sha1", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934180, "uuid": "ca54bd0c-ee10-44fa-9f01-c6a040ead67e", "comment": "Malware payload (SimpleHelp)", "value": "4968261c2850a8884483e6a36c063c6e1a0f62ff541d98174b470af22c30ea25aaae887f69ad4033ac8ca55b0ced3ba7", "object_relation": "sha3-384", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934180, "uuid": "74ca6ab4-6658-4d3f-b74b-a86363f6bf6d", "value": "T15E11B5167409C022C01BB99270FD9D0832818643F19BFF1B27FA226CD582BD7A973BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934180, "uuid": "63b1ced1-796f-428e-9f53-fb26fb24c86c", "value": "24:kwM+lqFB+52ZyTunK5si9PbK6FVtu+xqdB/07SusAZFnEy3w8e364j:kl+z5PTuK2iHq+xyB2SusmFnKX5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934180, "uuid": "30556870-ee2b-478b-bb0b-2cd29b068b06", "value": 1079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934180, "uuid": "4be310d3-bdcd-46cd-90a3-9045afd65548", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934180, "uuid": "3402e538-3cb5-41aa-98f5-4bf20f4abc34", "value": "Document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927a19ae-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928256, "uuid": "7387461d-ceb7-4416-aa9c-66c872396f34", "comment": "Malware payload", "value": "c6da62d99b32a30580390d01e616de92", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928256, "uuid": "dc9d436d-ff38-43f4-9513-a62542c0f767", "comment": "Malware payload", "value": "b0ce0b17d21cabc5a2881eaded298a616a9d6ae0be36db741d4d8e2b46c62b99", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928256, "uuid": "636271c0-e1b3-4486-a79a-4da151d0ee4a", "comment": "Malware payload", "value": "31711a02fb518aed9cd777c44f675223434104b8", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928256, "uuid": "bda38d1b-4ecf-42a3-8d6d-bc1089f849f5", "comment": "Malware payload", "value": "238c73f5792a44628903df18d90297a0fc144d097ea3f66cf73afd8e7f15f3cef2639e3b5985536fe24a0e22a2e2b114", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928256, "uuid": "5bf29dc7-88dd-458f-ac5c-fd6917afe6d1", "value": "T17127232B4D7D5F6D46582BD81C594A17D2EE0F48860CCCE6B7482DCE43A3E19389D2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928256, "uuid": "054123f9-c9fa-47d2-9a9e-eae64f883f81", "value": "49152:FJxWJxHJxqJx8JxTJxpJxbJx4JxIJx9Jx+JxfAJxAJx9JxpJxEJxuzJxFJxyJxmZ:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928256, "uuid": "35bb0b20-9e43-4d63-9c7d-bf8aba6581e0", "value": 22091559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928256, "uuid": "c8690800-ae46-4d7c-826f-6f9f98453960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928256, "uuid": "4c973894-65b0-475d-9022-aad49b646b53", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3ec307-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968462, "uuid": "3f217759-afad-436b-a04d-54e7b42c04d2", "comment": "Malware payload", "value": "125a7aa6997ad29874cb1c34cce3e511", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968462, "uuid": "81f0d271-5df1-4011-9ea5-09139ee65cad", "comment": "Malware payload", "value": "b13a41d094c4d26b413c3dc1c7d180a9e164f599964e114a78e2bb219c578f2e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968462, "uuid": "1b65348a-3c90-4756-982b-b5715b5c41bc", "comment": "Malware payload", "value": "52a449004ae06af208ec164cadc7a6470fd2908d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968462, "uuid": "882c8852-a496-4ccb-a2fe-77b6db0f931b", "comment": "Malware payload", "value": "981a221b4d00007092857deb34587bb0d8a35f88d1ce13b4763ce4e29dd6281c99eb0a4cf5e338a528cf27daff697422", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968462, "uuid": "73dce07d-76cd-4246-96a0-dcbcd8806982", "value": "T17E260186FF58952FC87700724FA683B532569C168E829B07B558332C6CB7AD80F5DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968462, "uuid": "c581ddce-fb17-459e-a32b-7ddc660bb959", "value": "98304:jDHU4Yjq/2KWV/Jymw6wAj4IXDU7vUKszXoHANJ3+hEs:fgyi/JTwBo4IzgXHAwEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968462, "uuid": "28abd9f4-0940-4738-96ea-de787d5b83e6", "value": 4505398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968462, "uuid": "e41d872a-81e8-4503-989a-82aa4f4e0ae0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968462, "uuid": "5e0d0382-b4f4-4701-a365-d44aa99c649b", "value": "b13a41d094c4d26b413c3dc1c7d180a9e164f599964e114a78e2bb219c578f2e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dc6edd-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927852, "uuid": "7cb206c4-d904-42dd-b701-77e762e63ab4", "comment": "Malware payload", "value": "e961a162de42ac8012a1c8ed6251592c", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927852, "uuid": "047ee98c-3362-4110-a491-62991b8cabec", "comment": "Malware payload", "value": "b1622d8b85bde554d09c3b197d34bc543d7157301c78746ae1d2f9a6654fc395", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927852, "uuid": "08fe8148-a4a7-45cc-97f9-e799b0e3cd54", "comment": "Malware payload", "value": "1e840dede54df4b7545ca8512c273d189aeb3caf", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927852, "uuid": "d0bdc0f6-a00b-4a64-b96c-d8666291e18b", "comment": "Malware payload", "value": "0eebbe5cf2bdb7e498a544daffaf0d9bf5b085b57e8af5d4d678bc669391f2483a369e3ddb6cc963b43b9f91cec47754", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927852, "uuid": "b53645a7-1c45-4ce2-8bf5-28817f022818", "value": "T1FE2723A29F2D0D3BC11C2284347F9A8DA7949C220A41A9B6D3DB0FA9478FD73351775E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927852, "uuid": "5b0ca85a-4ad4-43c2-9672-4eb98b9603aa", "value": "49152:78w8/8j8y8w8u8N8c8x8z828Zoi8S8x8t8+8Xoz8N8P808O8x8b8T8d8s8P8P8sz:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927852, "uuid": "7fcaa981-f404-49cf-a32d-eddd02d3b293", "value": 21611504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927852, "uuid": "65e4a4b7-23a1-478b-af9b-50b2d803a61e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927852, "uuid": "5878c180-43f2-4ade-afe0-86fc120fa70b", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4105b93-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927936, "uuid": "8267f5ae-8596-458f-8f36-5111a3489c7a", "comment": "Malware payload", "value": "e41ee22e0e9fc010d969d50f8b0e67bf", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927936, "uuid": "4457dda5-086c-4770-91bd-98e78c253ddb", "comment": "Malware payload", "value": "b243c26e93d45a61572da489b0ef18f517ba107835419a1eb7fede05e25e507b", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927936, "uuid": "b2d8172a-e9d8-4fd1-aa5f-f390bf76ea2d", "comment": "Malware payload", "value": "c7c906b558a2a1010622706809ea4af7554f47db", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927936, "uuid": "8669e0a3-0822-4488-9f8e-a61779ad9759", "comment": "Malware payload", "value": "9b8cdbad8ac2457ac71348c3e4d3ed191a17a47d148ca78d84aaa0a30861cf83b4bca828e6d60dbcad1f7506670d2a30", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927936, "uuid": "25215b0d-0868-4e47-a3aa-4575573c619d", "value": "T1BF2722437F9CA4D2C175711E04BF0F0DAA58C991E30AFD965EC9ADCFA426F0AE11689C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927936, "uuid": "ee9e0741-97cd-487e-9907-911087fc2a1e", "value": "49152:BvAWvAHvAXvA7vAEvAuvASvAxvA1vAcvALvAKs0vAJvATvAGvAtvAzstvAIvAzv/:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927936, "uuid": "ae5f2b9e-fdb6-40e1-840c-3154a3fba0f7", "value": 22091535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927936, "uuid": "be988c51-de8a-4f91-b393-70ef7b763517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927936, "uuid": "027fa9be-4ec6-4942-bb0a-09938a10afdb", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9547b354-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923106, "uuid": "169b453e-65fa-422c-bd46-9b8dd3cfb3a3", "comment": "Malware payload (Mirai)", "value": "dcf9ae237c0e83e0bb9ca1687aa9ab4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923106, "uuid": "1005fc66-5418-4391-ada2-e20f772e987f", "comment": "Malware payload (Mirai)", "value": "b2e863f0b529c89f0dc36b272fef49659a86c8af3eedf28eff5ca29d919d4831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923106, "uuid": "47d8fb84-2f93-4810-af5a-cfd3f237dc2c", "comment": "Malware payload (Mirai)", "value": "82c28a20cdda28b11a392de3923e561737f24b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923106, "uuid": "bfa00895-5f8e-4e63-b110-e605060fc477", "comment": "Malware payload (Mirai)", "value": "766c0bf24cfa0385672fe6d36e317392625c3ea617fb717e685ceb65e9738ea829bf0fcb81065c82fbdadf88fc4654a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923106, "uuid": "4cac40d3-e176-450f-9c99-8d37b810f7cb", "value": "T1C7D46BC5A6D3C0F1E56700F0189FDBEB1634D3224443DAF7E68C19A679A1F921A2B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923106, "uuid": "c99f96cd-2166-491c-986e-7409e3d15632", "value": "12288:j9h+0hK3lngrjnCAYbcNy/NjtzAmBQ+m3IpnPyIW52Lu:Jh+0hK3lnubCAY44htz3Q+m3Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923106, "uuid": "2612c6bf-f5de-4a7d-a041-762a940789d5", "value": 610664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923106, "uuid": "b7949a24-2fde-4a68-971e-eb2a8d430230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923106, "uuid": "c7ace1a7-6361-4752-88ca-6e4cfc8b9f18", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958f3e5c-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935133, "uuid": "51d00fad-c1a2-4a4a-811b-10aaf98d12e9", "comment": "Malware payload", "value": "8e43af7bb1961e87e35cecd9c9dc39c7", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935133, "uuid": "e82d5a01-8a6e-403a-b923-28126ff56e8a", "comment": "Malware payload", "value": "b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935133, "uuid": "d64a34a5-1671-46a9-add4-4726357cae1b", "comment": "Malware payload", "value": "b2b8eab958b77555160c95d89c7b5915f7d48a34", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935133, "uuid": "d09321a0-aa11-4165-8d6b-8ff051b36ab6", "comment": "Malware payload", "value": "94d202b04833f72e384164a5f945dc9e15fde664993e2f221230a582f7bea3dbbef0ea5f8e75a67831501cff7ae05911", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935133, "uuid": "5a11d4bd-db0d-4401-9142-e9c91c2e3352", "value": "T130D46E307A012EFF5BBC20C248DAC11C563C26B5C9686DF669CB4CA2391D77627B79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935133, "uuid": "ba252e2f-635a-4225-985c-ed8adb6dc527", "value": "6144:jA5zcHPjWGVjxtCgfqY1OLO8xGYpC6u8cUTKJukPuvIPgQF3rbhQB0Ktyb:AzyPjWGbzOy8R4kT0PaIPgQtrbG+KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935133, "uuid": "6dfd7ab3-6f20-4d09-bd82-6a7a9d9ee906", "value": 597919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935133, "uuid": "f38e0d80-e501-4c1d-82d3-fa6f6f4db8c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935133, "uuid": "c3ff8bb7-fe4b-41a9-bc80-a4199e2a85a3", "value": "b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163712f5-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982164, "uuid": "21767cee-f534-408a-aecf-6d7c6db645a2", "comment": "Malware payload (Mirai)", "value": "4d0a53e7188b97f2694b419a974a808b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982164, "uuid": "3ea12e40-d071-4505-9316-02d157b252f0", "comment": "Malware payload (Mirai)", "value": "b3a14ed840620fb4866477e6db70b141e17cf95c98cbfc89ef5a2d8b7884a6f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982164, "uuid": "b6370103-644d-437a-8ec8-5fe1fd2160c5", "comment": "Malware payload (Mirai)", "value": "177422e3d81cdc4c800eb744c1f782e4d34c19b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982164, "uuid": "71520e81-0962-4ee1-873a-92f55374b706", "comment": "Malware payload (Mirai)", "value": "9febb6988ba98531806e3adf2534d1c2780fc85ecadc66aafdc8d310039a1e6303acd185998ac7df86445af030d5cbc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982164, "uuid": "27cfefa7-32ba-4dd9-ad53-710fc400a6e2", "value": "T16B041A46EA404B13C0962BB5FADF421533239B6497EB73069528AFF43F8779E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982164, "uuid": "d3b8e76e-42c6-40c3-a601-5628cffc5018", "value": "3072:ZlMwlDcBZrkuaGDQZxBDyyxeslB5x9j/Sk5Yo+M/RpZu+9:ZJDc3AuaGDQZzD//BzR/Ff+M/RpZn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982164, "uuid": "596c41b3-bd3e-4e2e-8547-18dbc917c31f", "value": 174522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982164, "uuid": "a8e8238f-7cc4-435b-b61a-15c57be782fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982164, "uuid": "45bc5264-0c2a-42ea-b0c1-bcd8cfdd0b8f", "value": "concakhbtandhuy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd0525d-3f1e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776953721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953721, "uuid": "a42ea208-5cd3-48d4-bea4-a8b34d47c6ee", "comment": "Malware payload (ValleyRAT)", "value": "67f59d0134269a1b13d9cb9a68f35055", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953721, "uuid": "92173968-7c6b-4620-a3cc-bc8b079524d6", "comment": "Malware payload (ValleyRAT)", "value": "b3b83e6f324b2423a5c7eb2a478770bc2ecba1d6f2701e07363f2b915537ee83", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953721, "uuid": "bb2fc790-cc81-4ce1-804d-52abf38ae14d", "comment": "Malware payload (ValleyRAT)", "value": "48b702cdd9c689a83a69ba4a4f04e7a03ab921c7", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953721, "uuid": "2329d6d9-5b6d-4ea7-8a83-be3351ff41c1", "comment": "Malware payload (ValleyRAT)", "value": "bace5234eb274be133a12b253c087e35b5ed277ce1ada611ecd07853a4dc7ff47f2a6a9ea3ffa98679b88dd308ff9384", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953721, "uuid": "2800def4-804a-411c-897f-679edf2d5b12", "value": "T1C307338DCEB077E6E070F0B54453B176F19F624619AB3A2C7129B6AD1C5C0888E93B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953721, "uuid": "55754595-53f9-48b6-a2fb-e872bc37c4c2", "value": "393216:bmDG+KdMyrQSX5g4t/b594oIgCH5r2Gs0a9D:bz+7y5O2bUoQ1Zs1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776953721, "uuid": "c5750b5a-bed5-4ae2-afa4-d533b4b5f181", "value": 17860132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776953721, "uuid": "ea97ca18-038a-4985-a74d-964ba38ff932", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953721, "uuid": "c1ddd4d1-b36a-4ac8-a2c1-6ba9de03d517", "value": "Crystaldiskinfo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24e5b28-3f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776988465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988465, "uuid": "90bd5321-154a-403e-8067-fb9c2822481d", "comment": "Malware payload", "value": "1beefff39c6aed8ac8aa734649e9f0eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988465, "uuid": "b6121a65-139b-4a0f-ac45-4195bb0f6bd3", "comment": "Malware payload", "value": "b515b4ebe06041f29b19c8eb918fb290de044f2f5b7270e1c4e6ce7f0521d66a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988465, "uuid": "5bd7e4c7-e82f-45c9-8200-3da6553e40cd", "comment": "Malware payload", "value": "3f1b162d6bf1ac0ca555695ee6172f958342ae53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776988465, "uuid": "0fef6472-3606-4175-bd49-c9f6d213f4a1", "comment": "Malware payload", "value": "d15d176d3bee484f26cb7ae87b8dfb6af0d866d04ae713f7bcc8dbf0e9722eec99c9cce5ee6f75448333ee7caa073895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988465, "uuid": "731b2dbf-d562-4123-b929-9af3aa992a82", "value": "T1B793E884FE059B1BC6D372FBEB9D028D362B1FA8D7EA311699317EA023F55D1193A110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988465, "uuid": "e1f46f29-12ce-4fd4-a305-5009843e3b41", "value": "1536:8fxz4InbiuwDn+1GlEiLoOnnCSKp3nYW0IvYoSPt/:XDDn+1ViBCzt54/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776988465, "uuid": "fdc536e5-839b-4694-86fe-8fda12dcf43c", "value": 91064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776988465, "uuid": "fd4e4bef-0b95-4925-83cf-78a66aec8961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776988465, "uuid": "1157a5a1-4d47-4f67-9850-6d48d6e9e65f", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5aff65-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776930821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930821, "uuid": "2382b112-de44-413b-a59b-192290d157d4", "comment": "Malware payload", "value": "a03d505a8f169bfc0c365354f934ed40", "object_relation": "md5", "Tag": [ { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930821, "uuid": "258bf1bd-f109-4357-8e97-bee3c7802056", "comment": "Malware payload", "value": "b523e8cc1adfa9e8f83f872f27b4247f569769c8711a198ea054e0ec3854b82c", "object_relation": "sha256", "Tag": [ { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930821, "uuid": "d4510c95-5fcd-44b3-8fe9-ea0387ab3a48", "comment": "Malware payload", "value": "d352079b32dfa1c9d58cfd9e6ab0b9a6c5314761", "object_relation": "sha1", "Tag": [ { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930821, "uuid": "b1a63ee9-72a7-4331-b8c8-f148d421561d", "comment": "Malware payload", "value": "15bec63d4a42b4c68e494daff77d3dd7e30a30f81290547b47ca39bbcec8b3680288df021653ecdca635948f0a0b2cab", "object_relation": "sha3-384", "Tag": [ { "name": "machinesdelek-com", "colour": "#5D7044", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930821, "uuid": "d9d22aef-6c99-464a-a6c2-451650bdad0c", "value": "T17C0633213495553ADBF71632922FE8759E7DFE680B20D80B5700BA0E1971A8073B7BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930821, "uuid": "05889d60-34eb-4820-934f-e085a7a2523c", "value": "98304:1zTR+1v5E4czFQsbeuIC8CXY/YHKoLZH5qInz4NKfLoDSXgpaa:lIxa/hQHuIC1oYqoLZH5qIn8YLouXg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930821, "uuid": "74f21eb7-1808-472d-bbc6-f7dff454b183", "value": 3727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930821, "uuid": "71038f84-b8c8-440e-b86e-ac46af7e7352", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930821, "uuid": "5c55944d-6e9b-41cd-b29c-4eb7f228370d", "value": "b523e8cc1adfa9e8f83f872f27b4247f569769c8711a198ea054e0ec3854b82c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d991be8a-3ef2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776934817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934817, "uuid": "3b37c6c7-d2bc-4c3a-a16d-bf3f9498466c", "comment": "Malware payload (AsyncRAT)", "value": "5f071b58343cc80ef4f50dab25e4e87b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934817, "uuid": "e7c8435c-6dd9-4f6f-b936-f581ab894913", "comment": "Malware payload (AsyncRAT)", "value": "b5cc8276cff50bd4462303b5b0d2d4885cc1a6ba4a812fe7c4443afde8a76f3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934817, "uuid": "89b2a363-e6a4-4a03-92e7-37c74d6319f3", "comment": "Malware payload (AsyncRAT)", "value": "9db6759ec3e4c36797ccbd107b946fa7607c70b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934817, "uuid": "031f1fa4-0d2f-4da2-8ddc-243dc7bc4caa", "comment": "Malware payload (AsyncRAT)", "value": "1e376a5b12923bbb7f7a636e8b139ca7c9dd8f2baea821c067f22cfb6a8e0ddd376718f15c1fb073a2be05a395a7f761", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934817, "uuid": "798d90f4-e353-482e-86c5-a758f3696216", "value": "T165F423B52B64E643E4D343B10AF2D3325255AE4EF411C31BA6DEACEB78281F9786C351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934817, "uuid": "098c20fc-469b-4d4c-8f11-3f1fa874ed56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934817, "uuid": "80da2cfc-2bde-4e1c-9bd8-eaa19eeececf", "value": "12288:59SlMPjTUmMla76TnmDkoocFnwwc2qKRyEcpfhbncHbQTU0Y8ZrP+zlbC8lJL:DDTU7lkExoUwc2wEclhbnUcRZ6zl+8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934817, "uuid": "2cfe3e70-9f6b-4e1b-afd3-8f1fc0543de1", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934817, "uuid": "4df9c4aa-8231-42ea-aa3e-f795cf51169f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934817, "uuid": "09275261-6701-4677-8c7f-b61fe8484c53", "value": "z1BankRequestform2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee49e46b-3ef4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935711, "uuid": "182a281a-3a09-4e7b-bb58-6cb52b1cf5ab", "comment": "Malware payload", "value": "21bc6dc4ac9cb8fc8b6281dd527febc1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935711, "uuid": "0e0ad2fe-c69e-41ba-8444-e9730861e4a7", "comment": "Malware payload", "value": "b6332f09c0cfb08bdc6941af79d644d97acc9db003c2a43c09c4170cd00dde13", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935711, "uuid": "9d3935ac-5e53-4e59-aa3c-35f219604191", "comment": "Malware payload", "value": "23fb49d034cfec54e2edbc8a7f6aef3adf7396a1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935711, "uuid": "59bd2fe1-6d63-4ece-9eff-1420dcb7dae5", "comment": "Malware payload", "value": "2667844e190d134321a7c0156d27c0e2a32119dec6a6d413ee97cc780a17086d8d107eedb50c437b410333bfe69e5a21", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935711, "uuid": "55fdcc19-92de-4d00-892b-a35fb015d7a0", "value": "T14511841901B3508AA59D629365B9623A994E488B21387C608081FB2C57C7859EEFE522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935711, "uuid": "29e65046-10c2-4f6b-8e8f-dfadad48fc34", "value": "24:ZOrJb45CgvF/hQ4h9+BNDckJsx7ip4gga+zniqk0LerJYh4z:ZSJM3Q4bohckJa7iGa+znXeNYh4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935711, "uuid": "4fec5f09-ef3f-43c4-97bd-9b9ff64a9c81", "value": 902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935711, "uuid": "0745056a-0cea-484b-9d9e-b68742400c3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935711, "uuid": "ec0874b9-a5dd-4fb0-8d89-c9f39d831976", "value": "Statement.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498c2398-3ef7-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776936723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936723, "uuid": "8e0f8232-0927-4576-8190-3344c10ae64f", "comment": "Malware payload (njrat)", "value": "8368d91bcd80ff5da728f480167519d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936723, "uuid": "4183759b-ddfd-49c3-a129-0035c9aae810", "comment": "Malware payload (njrat)", "value": "b649944f79f7f0e8a1c550f92190015ce473b8841f8c14137a1e07154bf29774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936723, "uuid": "65bc0086-60f8-49f6-bbea-9aa3d09a46d1", "comment": "Malware payload (njrat)", "value": "c2de48b8d0241a5bb8d4811008ee74199982d7d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936723, "uuid": "d88ed9cb-7588-45dd-925f-8855a2b92f0e", "comment": "Malware payload (njrat)", "value": "b36d3d20879808911830ccafa255cce54dc8d4d2504cd578332953832ccdddb516b63d720198a6bbab4980a9126e8863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936723, "uuid": "57aaf7b8-4e6b-413b-bddc-af8cc32eded7", "value": "T10214F14273FC033CF6BA5E7469BAA914A977FE909C3DC94D5195710C08B3A64CAB1B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936723, "uuid": "972c8eae-0d9c-4788-85c9-71e8e81a53e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936723, "uuid": "02169cae-5eea-49c3-8a4e-0abd166c0333", "value": "3072:FyKbhBTfnele+aL26Ogi52ztMX/kipPTq/jLfuDX+gUy1i4woUDQut/T0j8z4OFo:tbf+arOgi5Q6X/u/nfuDX+Uo4woUDQue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936723, "uuid": "7706f520-9e75-47c4-b4c2-119c96a522d2", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936723, "uuid": "74f88d43-4a80-4754-b4cf-c5983646b4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936723, "uuid": "b64696f0-a296-4211-ab68-74e1dfa1e4b9", "value": "b649944f79f7f0e8a1c550f92190015ce473b8841f8c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f810382-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976140, "uuid": "6c252eb4-6039-4c25-bd26-8ad762fa67f1", "comment": "Malware payload (Mirai)", "value": "e6d4a9f28b4658528aebcf14c26bf0d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976140, "uuid": "111f4c85-8535-475d-b5db-6e2289ed529a", "comment": "Malware payload (Mirai)", "value": "b6652a40b6552269ed91faf6debba3cadee05ff75a5e64c0ad80d98a6115d6d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976140, "uuid": "169138d7-ae0b-4879-ab7d-0137dc99a236", "comment": "Malware payload (Mirai)", "value": "96bf54377ea13c55502847c8a21b0755146ec77b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976140, "uuid": "5c066fa4-9247-4582-8bdc-d451f35da126", "comment": "Malware payload (Mirai)", "value": "3fc1596b6116d57d7e2aed4369a029f97c9432cd93ce168b3b6b78bfbdef701dcc5fdebcdd5456963fc817e85f85b9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976140, "uuid": "5ed7d0ce-923e-4b89-9da4-fa7a8339e2cf", "value": "T1A3534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976140, "uuid": "d671b9a0-9882-4645-a85c-03b003edbc6d", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQHz0XYIfiV0/:BkfZJxFtojQlvnrj/a4LYZ76YN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976140, "uuid": "0596ad2e-3234-4f39-a82e-cc48767cf14c", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976140, "uuid": "898b802e-5c85-4ac9-b592-1e8a3a0c0439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976140, "uuid": "b463869f-7b30-4db6-8dc1-502e89aa71be", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef90d71-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776931578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931578, "uuid": "5f23dc4f-7e3d-4494-92bb-3cf764010f37", "comment": "Malware payload (AgentTesla)", "value": "08544b204010d011c9efa992c37461df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931578, "uuid": "1803c03c-7a0a-4489-b428-bd80b04c4a05", "comment": "Malware payload (AgentTesla)", "value": "b71287ca42de74cc0bfafbf2fda0191d0514df4c2ffc678ba884ba650aeff442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931578, "uuid": "a419b046-db17-44b3-b629-4cafd310c1d1", "comment": "Malware payload (AgentTesla)", "value": "ada450893e35bffc2f636eb6a3c3c2f421a2f3bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931578, "uuid": "d0383ec1-8da2-497c-b034-7113a06c50f7", "comment": "Malware payload (AgentTesla)", "value": "5cdff5e591e9e7f6b570855720b1b6014e8f67aaf5878eb1f0097732f1f9f95630aa0b0edcc5755b8786f733406ba9b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931578, "uuid": "f984c10a-11c7-4189-bcc5-0020c7686e83", "value": "T1CD6502158EC47FF9DFE8562D40FE151E93A04E8A4009A54EEB73BD4ABFE7B00521B099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931578, "uuid": "0167b1d4-124b-4143-9ffd-c6eca2b8bd70", "value": "24576:9kLStRdqZrXVhshwQWgeONzZJrM9ZidYxk13WCv+:9NXKrePVR/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931578, "uuid": "92b711ce-24e6-4194-a03b-a4923058556c", "value": 1449014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931578, "uuid": "0dc0c6e2-06e1-4ce5-ba65-5ec7c30867e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931578, "uuid": "bc441898-a34e-4cf3-9136-ebc544f2fcc7", "value": "SEA_DEPANDER_ORDER PO_4633.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7c6f7e-3f57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776977960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977960, "uuid": "e91d666e-cec8-4525-bdd0-698b4dbd7b58", "comment": "Malware payload", "value": "ba70643669c94937af56df13dc078bbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977960, "uuid": "9b3c8dd9-4df3-4df8-a143-fc4c809b15a2", "comment": "Malware payload", "value": "b73b6da7ad4730d624d127266b83a1492e9651251c39d233e3abb88a08733015", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977960, "uuid": "8f1645ac-f0c8-472f-ac25-d16b982a8cd7", "comment": "Malware payload", "value": "bf88f8bbee3098b8148f3b934f31b1ac134be2b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977960, "uuid": "2882593b-2031-4fe0-a5e6-c3c3ddc66548", "comment": "Malware payload", "value": "adfc4886f71987000645683bfab1160d90dd26cce45c88e9a067f0db7eb4d771b6e217f333cd96c60e1615e2ebc957a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977960, "uuid": "aea85d72-7f0b-4c04-af69-2d1dfc99b924", "value": "T1D27166095BD88677E0A70730AEF30317A6B0F9A09BB3472E05D05225AC616B80EB1B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977960, "uuid": "fdad14c3-d991-42e8-a169-f3dcbc1a954d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977960, "uuid": "89da0fcf-19cb-4e78-93d0-b600506c5ef6", "value": "48:6QGVV+UFFJQaIPaBPJY5mSb91ulga3Mq:aV+UFFeaIyJOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776977960, "uuid": "ad59835e-25dc-4020-b794-3381e37e9177", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776977960, "uuid": "727034e0-5384-4e7e-b699-9f2ef7388839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977960, "uuid": "684f1393-c40d-4d18-b11f-24fa8cb28792", "value": "vmbmv51n.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc7f8d4-3f07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776943869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943869, "uuid": "2f1ca4d4-6048-4d25-b235-9e6c45f592cb", "comment": "Malware payload", "value": "03ab24ebcfc8e7db24aa14a0335d0124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943869, "uuid": "cabc01fd-b226-4029-a329-64d2151874f9", "comment": "Malware payload", "value": "b83f8915cf411c6e2933751a8495c92bce099025c94b3cb7e82b0ad54669df6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943869, "uuid": "452a36aa-84a5-4b6c-ab36-9851308ffccc", "comment": "Malware payload", "value": "86b3783487557a62c0ea4f5a3d20639bb50a86a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943869, "uuid": "4f43c9bb-3fcf-46a1-b630-8fec8521dca2", "comment": "Malware payload", "value": "a59d3fec86d07ff4415cd6914e5d342cda0602979e25c6588582ff278bc329797f2da005d3ff7da4d79bbf0750e0e368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943869, "uuid": "398d90c2-315b-4b5c-a1a3-781f29ce0fad", "value": "T1FF542F3EAF2158B9C1D74174BBCBEDF16926ED5A0634A04E06C6EA01398FC704BDE6C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943869, "uuid": "3943bf7d-26c1-4368-853c-f79e2c5aae5d", "value": "93590a6bdf597c0d6bebed25a6e9c5b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943869, "uuid": "9786feb4-00c5-48d5-9a07-dc3a187a585f", "value": "6144:zU1E4X09Vher9q6u1xDWEMyBh5c8ydGd+HWedvTNa329RTU71plks:I1E4X09VherYxDWEMyBh5c8ydGd+HWex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776943869, "uuid": "aa1109d4-c00f-42ab-bf29-4fd8e1847500", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776943869, "uuid": "7e387f89-12b5-490d-be4f-2c92bbb52c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943869, "uuid": "2e7c48dc-366e-4268-a73f-7c55720f72e7", "value": "OnlineChecks.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbe2bb1-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776931199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "2491efaf-f364-4e97-bb70-d92985442f4f", "comment": "Malware payload (Mirai)", "value": "a747ae2c2c1b28f5691eea20c4c4c72a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "3ff6a5b4-5130-4684-ac52-02d9d84e7344", "comment": "Malware payload (Mirai)", "value": "b84a314e502d9e4bee9e1ba10f67026ce2560491ab0e1016289c7b3260836e12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "28e7fb66-e08e-4a19-a86a-f0a27eee29d3", "comment": "Malware payload (Mirai)", "value": "77011be377a3fd02db74deaccaa705b354a72f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931199, "uuid": "0a09ad08-a5fc-4d8c-826c-44e3a6fcfc49", "comment": "Malware payload (Mirai)", "value": "b856a39b9e1a8878f277fe157fb895d2acc60a21603a2b700b4718ed760d40c18791fe4d25a85ea125abc8cf9aa7673e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "79e4faba-d87a-4cec-a3c1-eb32e6f961fd", "value": "T16E230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "6eab7281-dfb3-4d79-ac6b-424912ddac4a", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THm:5DmKF7Gxyk8cqoHAmWurAufsG5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931199, "uuid": "a4311622-0765-4588-b1a0-e64419532ba7", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931199, "uuid": "10c15a2c-50c5-4ed8-8d58-6c83f8771ad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931199, "uuid": "fcb7dbaf-5d74-4c0d-a763-2cfe79214876", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdf0c15-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776928513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928513, "uuid": "1cb76539-66d6-4ec2-b3ea-a554b0279d38", "comment": "Malware payload (Mirai)", "value": "e1842ba3b09950e4a2a931ce4e4ad636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928513, "uuid": "4c0c2b7b-0376-4184-96cf-4f2e232f136a", "comment": "Malware payload (Mirai)", "value": "b8639d9c6b1c903cc3daee2be163c1c925db0a9bee46158e9730f4627b2e6ed1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928513, "uuid": "af02a416-23a9-41da-8c4f-06d38ee96082", "comment": "Malware payload (Mirai)", "value": "1ce4ad953eca7fddf62d05e47217586851a46468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928513, "uuid": "58882227-1c1b-4cef-a152-0e24ba50ca60", "comment": "Malware payload (Mirai)", "value": "a9f044ce4fe7fc59d2fbb9ce2b6bc2dc0311f1e11645808b35373c7f58ab6291d4ebf14af5fa09a306151e652ea590e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928513, "uuid": "1b4e15b0-e014-48c0-ae2e-62d526beef81", "value": "T104A2D01572632D56E3ED2C3DC9AA8317FD661BFC80F6327669415620C94D24A3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928513, "uuid": "883d93b8-4789-4171-a178-a142e6eecd87", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj/8JwhymdGUop5hm:TvQn4j+ZO5fKAlxjGws3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928513, "uuid": "39c1c5c1-30ba-4b8b-b493-504d21934a17", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928513, "uuid": "25e455fa-3e4a-42a1-ab6a-090478b12379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928513, "uuid": "d22e208a-d28a-4912-a76b-b67f75156101", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf3b6ed-3f36-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776963760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963760, "uuid": "6ba938bf-6038-4216-ade0-396f272903a6", "comment": "Malware payload (ConnectWise)", "value": "10f244c247ce299f410c1b1de154b79a", "object_relation": "md5", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963760, "uuid": "5522374d-a7b2-4ffd-b678-6e9b0341ac16", "comment": "Malware payload (ConnectWise)", "value": "b92023cb105119ad45460f165a12b09e3a2019d1de2bfbdfd7591cd55164f4b2", "object_relation": "sha256", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963760, "uuid": "7708b454-77b5-453d-9a73-003ea284a929", "comment": "Malware payload (ConnectWise)", "value": "782223475bbb40d29f2ce68550c14823b8b42436", "object_relation": "sha1", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963760, "uuid": "ba104b53-28c1-43f5-85f4-47275452a705", "comment": "Malware payload (ConnectWise)", "value": "f5e641d8a27f52a5ca8f8f77256c4b7fcac2f192fec90e0a67aa1629de0eb42706e940efd0f013abd930b905199a994d", "object_relation": "sha3-384", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963760, "uuid": "a462b3e0-7e88-43ec-a4cd-15b0d9036036", "value": "T1DE46F141B3D695B5D0BF0678D87A52AA5A34BC048712C7FF57A4BD293D327C08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963760, "uuid": "896d9cca-f7c2-46e7-9da5-aa58eb7d9e21", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963760, "uuid": "a6dd387c-0b41-4b4e-8955-5175b62a598b", "value": "98304:ads6efPc66x9G6GYjTG7WSvhrG9N9vlcU:4fefPQHGYjMi9N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963760, "uuid": "ccf71883-5cec-4f78-b35c-c926c76e4a8e", "value": 5616728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963760, "uuid": "f135a44d-e794-4444-b0ae-588861808984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963760, "uuid": "ad3ce5e4-bc5f-4445-9d41-e0f0b7cdc1a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2c5991-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923068, "uuid": "cebeea83-1b1e-4271-8964-f843ecbdee4b", "comment": "Malware payload (Mirai)", "value": "d8a17af2f9f107c6f7c94f0ac195ed70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923068, "uuid": "7bdf5a45-b647-4cc0-8489-8f925bda8ab8", "comment": "Malware payload (Mirai)", "value": "b952a69d929cc2f906cac67cc88724245db954b98b8007855d03ef2ce012ef23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923068, "uuid": "6b5989f9-3b02-4681-a9bc-4e4560006db0", "comment": "Malware payload (Mirai)", "value": "6e72294bb3d4e933f3c9d3070f0bfcc3fdea1e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923068, "uuid": "8f61eefd-cf4f-43de-8fdc-bdb0fd51e965", "comment": "Malware payload (Mirai)", "value": "0db8bb0ed9eaee3080494abe2af032665e0c7733d40ea3cc56028a442fb93dff869c55f7eb1b38ea18b44da277b27d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923068, "uuid": "2a10d91a-4974-4442-bd98-1596e241ea87", "value": "T1A8B28DF1B2077CD2D461EB3658D083252993F13D1AE3A3863764EBDFB83ABA11927154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923068, "uuid": "5f9053f5-2171-4fcc-b363-b8c1f9cc970a", "value": "384:KQxxMtu+61W/mlbo06gIKn4rBVVHUubSdrFLLygiLptib1B+IYa:JStWW/mW3gIKn4rBVZUub4rFLXiyAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923068, "uuid": "3c68438c-993f-49cc-b152-f5b929f0bf55", "value": 25484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923068, "uuid": "44f5b3b3-49ee-4dc3-8149-6d9c8606e265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923068, "uuid": "ca53a294-1580-4c20-9edc-56c772ec4156", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ac2fa0-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924342, "uuid": "a0862576-6ef1-44e8-990e-a7af4400c798", "comment": "Malware payload (Mirai)", "value": "4ff8e5477950a24fee9cbbc8b3a63ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924342, "uuid": "4003997a-b182-4ef0-8ec1-268c8e23202f", "comment": "Malware payload (Mirai)", "value": "b95415f0036409418073ef58d81ace9a00cfae0f942a4f7e9e90b2b54764a554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924342, "uuid": "0de0b7e0-1854-43a9-9a0d-a623b9979a52", "comment": "Malware payload (Mirai)", "value": "b2a9308dc5121d241c8bf0a693b03e6ec54e8944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924342, "uuid": "5a7b8ee5-6960-44ee-8642-f226c4f32f6b", "comment": "Malware payload (Mirai)", "value": "f44fc6dc21bb6ca7db9241a239041bc4724bd5a64de715a93a7f30d1dc912ec56c567ed903df59a4d3b1bf0c1dc0313d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924342, "uuid": "958162f9-a193-4858-b9db-ac3d467183a8", "value": "T190834A17798080FCC49AC17847AF713AC472B53E123DB2AA6BD4EF263D49E201F2D5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924342, "uuid": "0460b893-686d-494d-a190-fb9f01fed20d", "value": "1536:+JtlNc/hpugE6QTqnnrfN8SaIP+mYpQINtavyn3IJELqQu+ojOZUS:UlNc/HugdQmnj+mWm0QIGvynGELJu+oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924342, "uuid": "ac92c0d7-aae6-4fc0-b9bd-6770adc7d8fb", "value": 81648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924342, "uuid": "56b53871-015d-433a-8762-94bad7fab131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924342, "uuid": "199876d2-bd7b-465b-912a-eec9f0acd7c5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a153fb68-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776931717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931717, "uuid": "a3a60282-584e-4261-88d4-691a1766de81", "comment": "Malware payload (SnakeKeylogger)", "value": "b9dad8b144d87aa85f26bfa1b5d5df21", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931717, "uuid": "2736f93b-f3e3-4410-9c77-619c0adfd218", "comment": "Malware payload (SnakeKeylogger)", "value": "b9552a61439efa4fd9680202397d790306d88d393b73a6be6171403cdd35a0dd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931717, "uuid": "82eb43c0-7de8-494a-9e99-de4545c27eab", "comment": "Malware payload (SnakeKeylogger)", "value": "0c906b9d7761cb6da086272504fc8d048fc59d10", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931717, "uuid": "c174f99f-a88d-4e6e-a64d-d44c58d8c79b", "comment": "Malware payload (SnakeKeylogger)", "value": "abec8f140984cdf4faf73f1ef09c083cae534c871dbd8459348b1fb65eed2fe9edaf58c8040b29caf3b1492f82220e54", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931717, "uuid": "f0eadf29-55b5-4c84-9219-ed53510ffc56", "value": "T19054F12389C83F69CFB85E2854BD161A73608A5F5419164BEBA77C4B7EBF504220F2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931717, "uuid": "af39fe25-e033-48b6-a66b-afa04159ef0b", "value": "6144:5ppH/gDRvgt5IP5LspACwKrLw00SvxRx7GYI41X:rm85IPFEACwKJ/x7LI41X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931717, "uuid": "b2eb9ebb-d618-4c28-a96c-5b7d598c2761", "value": 303406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931717, "uuid": "dff42b57-f128-4eff-a253-5d5dcd94dcd9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931717, "uuid": "29cf5f8c-60a4-479b-9310-c470b858a37a", "value": "MV_LIBRETY_KING_V_MAIN_INFO.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148f83da-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976148, "uuid": "a234d845-e8d6-414b-b345-2e6d785dfb02", "comment": "Malware payload (Mirai)", "value": "88c7765815ccce61c29e0153c2c74377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976148, "uuid": "e4cea294-e43e-494a-9a69-23b419038810", "comment": "Malware payload (Mirai)", "value": "b9c35f15234d67018aa9a8e3b419d163149c092401709d5748661059e5ec3e27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976148, "uuid": "469e4231-4499-4f8e-9e80-647f44c27258", "comment": "Malware payload (Mirai)", "value": "5cf48f0c83ef5d28d7ad88c28a8a0fe9eb31710e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976148, "uuid": "0223a585-98d3-4705-b3f0-e48fb3b8f850", "comment": "Malware payload (Mirai)", "value": "23ca1d16899748e2e8942d56928285bc89efe3603a6ae75c4e22dff03805e3031ae9522a830b32d825beb2026e9be0bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976148, "uuid": "ab8efd67-67bd-4ec5-b2c4-0c502503d1d7", "value": "T1EF73F819BF610F77EC6BCC370AA92B0129CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976148, "uuid": "e4334871-4123-45b4-94de-c3127ab31d62", "value": "1536:7J5dbFB4x92nKoIya98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKoLIUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976148, "uuid": "faa55b0c-3ecc-446b-a52a-79f6e35d8ef9", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976148, "uuid": "039d414b-9dc8-4162-b297-615b2216bcbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976148, "uuid": "5877781b-fdf7-4237-97a5-de918395b8cd", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e902496-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985614, "uuid": "c1dc60de-c9c2-4595-8733-321ce0cc9978", "comment": "Malware payload", "value": "c7592d09d79d1c07f6077d02b8253e85", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985614, "uuid": "250e60b4-1b0d-408d-ac54-e5b321536b7a", "comment": "Malware payload", "value": "b9c8c200bc47b6eb72efb1707a5e71b544f66edab655637df306111ba6d042aa", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985614, "uuid": "6a3ee9ee-f52d-4121-a0f3-c14a32dda77e", "comment": "Malware payload", "value": "a9d6e7287014d50c066023d2f92ce9c78df546b8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985614, "uuid": "f8b4ea74-37c3-420c-bdf4-ca6bfd9d02a0", "comment": "Malware payload", "value": "a690c15452b99dc8e5e6bd8498dd55072c82b1e6241b090e9434d9da32c855d8b36565b72eb94c4114901b3b238fa24d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985614, "uuid": "db9c907d-b3a7-40fe-9a86-e9d71100c9f2", "value": "T101930180251569FEAD4A9335517AD97CC31D540BF4DB78A1B473E0FA394A30BDA8F087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985614, "uuid": "43d692ef-e203-4e41-8153-e7d8700cc924", "value": "1536:rYF8lP2gyc2xQ2pg2T0rhnf1TGL5AC4G20CQtT0o4Iofmfu6F/sZ9Q:rSYVyng2ArfYNCQtT0oHymfu6+Z9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985614, "uuid": "3b3b6a25-176d-4d0e-ba9a-bb90e39a528c", "value": 89790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985614, "uuid": "f4bdb449-3c8a-4d3f-aff2-300146febb96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985614, "uuid": "19488498-8c68-4f28-92ef-f0af3ace918a", "value": "ought.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cb0c1c-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955856, "uuid": "92670e7e-2e4c-4cda-8343-4419742c9374", "comment": "Malware payload", "value": "c434089c2c9f6679cc0597c9e2898379", "object_relation": "md5", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955856, "uuid": "bfe29844-5c2f-4c9b-a436-795ea15e884e", "comment": "Malware payload", "value": "bad329aa83a44a3cad010b15ee1b03ac8479dfd1b29318f7c4c804e29b57aaa3", "object_relation": "sha256", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955856, "uuid": "386beafe-8451-44d8-bfbb-201c1a7115f0", "comment": "Malware payload", "value": "3764ba46f89fcebc18b746c14d6b4f6e73ca86d4", "object_relation": "sha1", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955856, "uuid": "24d6a5cb-4dc9-4f93-84d7-561991d197df", "comment": "Malware payload", "value": "ab7985d776ee20119a0956b33e2fddbc6e6da48d36a4b6cc42d2f28c2035b1c244c9d59b247b4fbe88cce3737fac2048", "object_relation": "sha3-384", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955856, "uuid": "f2e1ac07-19d2-4b78-859a-1a3d83e3ac80", "value": "T14241DD9AEF251C30B94C057CE81A611428C64B23027C3E9176DFA9189F1D74FE366E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955856, "uuid": "e1aca219-619d-4b62-b52e-104c85199230", "value": "48:xhoaU7MyE91E3KKwyQ4B53hwNwrmJSPCYQA4jm39zFYgAwAo:xhoaeMF1E6Hy5gSPCYp4jmNzFf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955856, "uuid": "eb8ec0d5-3518-4ce2-a123-6e9a3a4fb839", "value": 2346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955856, "uuid": "cae060cd-5fc1-4f8c-bad9-877032fe46a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955856, "uuid": "b03c4bfe-2a25-4620-9786-815fc59bcbff", "value": "bad329aa83a44a3cad010b15ee1b03ac8479dfd1b29318f7c4c804e29b57aaa3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167bef25-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928048, "uuid": "a56e8d80-c35b-461f-8470-591513eb9526", "comment": "Malware payload", "value": "d321d9bfb46b03d680ce411681e38292", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928048, "uuid": "7084ffde-1a9b-4bc2-837c-73d6b5b5883f", "comment": "Malware payload", "value": "bb467ce27e2aa7bbc6998555fb1d1133390d49a53089ed11ddd4b7e446afa7a5", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928048, "uuid": "8b61d7bf-16d4-41ba-9c59-cc191ae9f48e", "comment": "Malware payload", "value": "10294104cd17933d0fcd254242a7d0a197b97e5d", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928048, "uuid": "8c6ebd03-5408-47e1-be8d-a8f1942da74a", "comment": "Malware payload", "value": "47f56c7d0b99bea5ea6698022332ed6c2f526a56d2f8dcc58e45f8cc38e255e804da6089ddaca255a05c73324ed7e938", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928048, "uuid": "6670cc0b-d5a0-40f4-b42d-12bb4cbddb3e", "value": "T1C5272319ED1F91ECCA6DA25C90EF097E13FC0F5580302F94A7AF2A4D1E9FD6D190A186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928048, "uuid": "7d724a8f-a062-4791-9c21-86321c893462", "value": "49152:plSl/lzlxl4l+lmlelVl8lUlzP/PlrlKlQl3l3P/OlRlnltlWlMlMlElelPlulw+:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928048, "uuid": "f2370699-3b6f-4f9f-ba97-1c354e9857be", "value": 21371480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928048, "uuid": "15a92901-b4b9-4b95-9444-a51c1006e638", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928048, "uuid": "208ed60e-707f-41de-a488-3bdc8eeb6fce", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c70720-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935157, "uuid": "73323b55-9d7c-4787-9190-3c539ad5b775", "comment": "Malware payload", "value": "bc877061ed233cd361e6a7dc1b1cdbc5", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935157, "uuid": "2bca07e4-52cb-40ba-8c6a-f7c51faf82f7", "comment": "Malware payload", "value": "bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935157, "uuid": "a11ee592-adac-4665-897f-c6a23aa52ee4", "comment": "Malware payload", "value": "93fb3e5598d21a224c653314ceb7a4305b6ee121", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935157, "uuid": "7b07eb00-cebe-4ad3-ab37-40bb6d8be475", "comment": "Malware payload", "value": "03b3314a44139c8047d918ae7eb77573195499f4e0ea2cd31eefb2d983ba634172ebb06f8ccd769282eb279329463668", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935157, "uuid": "c101ee76-1e3d-4f17-a271-26fb56831d04", "value": "T107C46D607A411EFF5BB820C248CAC11C563C27B4DA686CF56ACF4CA2391D77627B79B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935157, "uuid": "edc1691f-b3f8-459f-9726-56e4524a2a17", "value": "6144:uevfnshpxXurPTBd+lRJqdHM2OnfUymxD0TWAv6qQHKUPUs6qsJM+OSaH1CW:ls31aPGlRJQHTOsyIDxpqvsUs6q5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935157, "uuid": "60082731-7f57-4f6c-9025-42ed2d8565ab", "value": 575460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935157, "uuid": "377b4da6-2a07-4a07-b1af-17e2ac0bd14b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935157, "uuid": "c3e4f462-230d-4c09-bfa5-0ad251e6c48f", "value": "bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837e389c-3f00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776940686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940686, "uuid": "7cda4309-4486-4ff1-8491-3fc287daa6c5", "comment": "Malware payload", "value": "39ca07c44ae87cbddec60351db3af790", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940686, "uuid": "c1e98bd2-9fc9-4c20-a7c6-7ef3b3d1be0d", "comment": "Malware payload", "value": "bb883d811400a212eeea74b1c790a1ca71a6e94b22042dfbcbd2903c385e0360", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940686, "uuid": "43f47989-6d6a-4478-9b4c-8c28a2d1a972", "comment": "Malware payload", "value": "73929a1dc13391de139fd23e004ecf173b1259bf", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940686, "uuid": "d6af3127-6573-4004-ab14-98a99c7908f1", "comment": "Malware payload", "value": "49a47eaec2101f5a547a9cf76b4d9036708485c8dec2e0c7dfa2ea30ed12aff8c02bd0ada8cdd00c77259e7b39d292f4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940686, "uuid": "99769e09-c9fc-40bb-b44c-98a91dad0481", "value": "T12CA4126E65E723FCCCB5D1B9968362A1B2F731A6933D4BABC382503532759C0197AF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940686, "uuid": "28a7ac6e-25ee-4439-ad0a-7fa0ec83481f", "value": "ff187e9c33ca1d4e71b2277cca5c4e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940686, "uuid": "95f12a22-5075-45fd-adb9-d7cf79ddc8db", "value": "12288:8dIhol8SLBfhkFcqgaesCYPcYYmPpbwi1mZht:FhcLQuqM5YkYYIbxeht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776940686, "uuid": "ef81c57b-d8d4-4465-90a4-29581f076770", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776940686, "uuid": "b69573a1-fafd-4b42-bff3-b69ab3816ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940686, "uuid": "5d7e639a-8fab-4eb3-90b1-dce67ffd26e5", "value": "deq4qnvs.sci.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d80325-3f01-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776941274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941274, "uuid": "cff87f77-76bd-4035-a8b1-22b439e15c05", "comment": "Malware payload (WeedHack)", "value": "f5108d0fe14daaaac7b482ee4228fcca", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941274, "uuid": "c1304382-d5f2-45ff-bca8-6bc201bba029", "comment": "Malware payload (WeedHack)", "value": "bc22370f02477fca7314daf9812654aacab361326d909147367adeddf155d3de", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941274, "uuid": "b7696451-a7aa-4a0b-aa92-eedf5ae80d07", "comment": "Malware payload (WeedHack)", "value": "d2590c72d87558984a14ebcbe0e2ee4f6427e5a1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941274, "uuid": "f54bdbec-5be6-4b08-bb9d-12c161fd42e5", "comment": "Malware payload (WeedHack)", "value": "5989869ec463045269f27adfa3b7964dc4036f3497bbab01665f32cc8887a34e664fa255750c8a12320b3bfcf33b2df0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941274, "uuid": "d699ab0d-b4ca-49b7-90b3-95adce0b2116", "value": "T14BB423D5C6464018EEEACF31A3A8D3D3FA3B24789314285C07DAB6F64D4299BFC8855D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941274, "uuid": "9cafccc1-b5fa-41f3-9640-d5f99b6d9ac8", "value": "6144:jPcYiL0Ym26x71oBK6zvcRmMc3Dhe6cBmf0TFW1jKAOG1XZdreIlzO6/7CVZoiHa:jUVIQ050IBcTheNwBKSZ1VlaJbGb+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776941274, "uuid": "fd493694-4f1b-48fa-9e11-2ef8cc89b3bf", "value": 507252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776941274, "uuid": "3181da4d-34d8-446a-b427-74421e622eb1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941274, "uuid": "77754e68-f183-459f-aedf-55d441fde448", "value": "DonutDupe1.21-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349c55b4-3eb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776910059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910059, "uuid": "e904eb3f-f89c-4b06-8b39-113982bd6d65", "comment": "Malware payload", "value": "53062a067d23ec46fba15b6d2cea672d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910059, "uuid": "d2e17221-ca21-4c74-9f8a-8a59b32fc32f", "comment": "Malware payload", "value": "bc4398448cea0dce1a025b061145801b0ba27f7840f4298748ea9302408024b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910059, "uuid": "de765184-0eaf-42a8-ae8f-aac4ede79081", "comment": "Malware payload", "value": "12809654ca28bd7391d820ed34176755eb2561f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910059, "uuid": "a957d217-2796-446f-ba6d-da2a1d220818", "comment": "Malware payload", "value": "8ffdf73b7f3fa82c5107e1dde019debe51cf67887f221c6ef3d067c33f6bbc6741e5c769a32f6ff3a0ce36c01aa601d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910059, "uuid": "b9232449-d595-4ab4-aabf-dc90824cdec6", "value": "T13071EB06DBE84127E4BA0774BEF34B566AB0F8A49F73571D09A04329AC713A45D72BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910059, "uuid": "0b272ada-5a71-4cec-b1c6-bee849f5a150", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910059, "uuid": "888b4293-7996-437c-a8a0-b96f1785fdce", "value": "24:etGSk9OAzEO3h3N0OLggLYVvs/521lyPKFcLtkZf15mosFDst2WI+ycuZhNNakS4:6wj1LggLYpshoc9aJ15mpk91ulNa3Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776910059, "uuid": "e5f1b71e-f079-4012-be7a-8e6eb58096d5", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776910059, "uuid": "07bb9824-cbf8-4d1a-b345-24260d040d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910059, "uuid": "b807df2b-248b-486a-a71f-38407289b39f", "value": "vpuuaqjs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cfd7b0-3f24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956019, "uuid": "9bf7f901-ec7f-4b3d-8155-abb9cf198ae2", "comment": "Malware payload", "value": "a16b3749936412b942327bf4bb0f6f3d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956019, "uuid": "e34e652c-1745-4a9b-9799-d15d495e5ad9", "comment": "Malware payload", "value": "bc877d871e342272ef65e4e8fd3fc5101e7447f51884705037ad67d8821d4ba1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956019, "uuid": "fbef0a07-95f2-4574-b2c2-b7baa104bb7f", "comment": "Malware payload", "value": "1559703b71ccd6e19656c575a4f1a73fcc82b7d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956019, "uuid": "fe931784-b9d2-4410-bc75-35083f5ca5c4", "comment": "Malware payload", "value": "724e00025519fb17c61127f2fc9739f22f9fae3fe927ffc13ccfeb330f458fe965d2311c3af23dc615c7c660f1292428", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956019, "uuid": "8b5d071b-e2f9-4f71-914f-d28c8a2683e7", "value": "T1F4E53326F9200AEDD515663520BB52E6F15EE42FA842810D073B7E93B10FF98C796FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956019, "uuid": "13554fc7-238c-41c3-93f4-ed32cd3f948e", "value": "98304:LEO7YkdkyoCN22X7Zfz312WmU4IMmhMAUIgODHt0:LrYkdkyNXj1CtIM2BXg2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956019, "uuid": "37fa2b93-6d91-45c3-bebc-b1197225b0b0", "value": 3226441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956019, "uuid": "0a790c4d-65d0-48f6-96c4-9c2ef107b714", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956019, "uuid": "f36f6b0f-7daf-48e7-8360-4c328404b0d2", "value": "bc877d871e342272ef65e4e8fd3fc5101e7447f51884705037ad67d8821d4ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22de9f4-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923128, "uuid": "530822db-9912-4e1b-bb9b-42c6f2debc5f", "comment": "Malware payload (Mirai)", "value": "039c4ac687f3ec6ba9d5f59f9bf4ff27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923128, "uuid": "7f23d18e-51e4-4557-b4da-6acae03ea1d6", "comment": "Malware payload (Mirai)", "value": "bd050d8a5106f5358ed93361cc5102da65cdc7a83a62369ec3efb73ead20da9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923128, "uuid": "18869ec4-9bd1-4b33-aec8-3f697ee2357b", "comment": "Malware payload (Mirai)", "value": "e0b4ba962903957a593d214bc0c1dce6b11a420d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923128, "uuid": "906b6db6-177b-4fa6-b378-32c2c1bbd1bf", "comment": "Malware payload (Mirai)", "value": "3685381f075513ee5686775f599f93db5be4194ffaf8f66588c702ac7fc60824adbaf56d3d7bcbe2136fa731cfdbde5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923128, "uuid": "7072ab64-6800-4a34-bbee-1e97cf199eb7", "value": "T1FC359C2AB2B3B1BDD007C03447DBCAA15531F0755A322D7F27C4DA393EA6DA41369B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923128, "uuid": "4c093c48-a27e-46d2-80f2-128f3f643e51", "value": "24576:s1sz9AUJNgtsQXAZlK4QxDPYQl4aMZWL+U:su9JJNgeQKKrDbClZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923128, "uuid": "16bc5991-b0dd-4ba5-b636-22fe698ac429", "value": 1064752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923128, "uuid": "a325ac1f-b990-4d0f-9ef0-64aac7e10200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923128, "uuid": "fd3783be-3f08-4bc8-9648-6a0d7b427e2e", "value": "svc.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9964cf32-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923113, "uuid": "c37424c8-5866-4d37-9571-13ec203dd17e", "comment": "Malware payload (Mirai)", "value": "6623d63b070f09b7569928cba3bf4b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923113, "uuid": "3c5a75d9-d629-4991-a22f-3ff8a4e4e22f", "comment": "Malware payload (Mirai)", "value": "bd147e92c4e1523d5f6a0e7d78629544d663daa80dd2ed5b641a03cee023fb85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923113, "uuid": "8866ac6a-0a57-499b-93f6-c31de093b4fc", "comment": "Malware payload (Mirai)", "value": "2a0329196cb203aa768da29873e3d601053bab7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923113, "uuid": "8fa1773a-e8cb-40d4-a25a-6a46c6d00a71", "comment": "Malware payload (Mirai)", "value": "d13e45deba5730991c06176f3110801e38af11e0030c0a46725555bb86a82e126b0d0cc89a9945af41f7adb55c8bb460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923113, "uuid": "3d689b4e-dabf-42c0-b4de-850c988493dc", "value": "T1EC058D63B7318F68E761D27504E3C7619A9520A30BE291C6D37CC6207A50A6D6C6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923113, "uuid": "23affd4a-bb12-4154-8b8c-0804689ae7ba", "value": "24576:n0XrR+zvMuS+VnxGm4UZGl/FCaemcdTr70M8L:n6rR+zvMuS+n4UU/FqmwTr7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923113, "uuid": "0e2cbe81-1574-4a05-a923-1499351f842b", "value": 860516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923113, "uuid": "0f9a29a5-69a0-493f-a65f-476f395b4ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923113, "uuid": "6d54933e-2f52-40b3-a5bc-1ddbdacae3e3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ddc492-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776964346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964346, "uuid": "8697308b-98fa-4cfd-bc13-f0f1de5367e1", "comment": "Malware payload", "value": "ff24eae11453cca0687c832a9c8dbdef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mamont", "colour": "#D5B2E4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964346, "uuid": "ed57dcc6-be9a-4852-bd7c-6921aab4b4ca", "comment": "Malware payload", "value": "bd8d876a63c55a252a600f565c9ccc0f9d2375a0a341b84f5821b07d85f111de", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mamont", "colour": "#D5B2E4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964346, "uuid": "4ab75c36-6257-4ad6-8347-825e702ce331", "comment": "Malware payload", "value": "ab7f49f42de87ae67e5eef01c7eceed3d80052e0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mamont", "colour": "#D5B2E4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964346, "uuid": "19e408b0-1a91-4f9e-b2c9-c362a6ad0f4d", "comment": "Malware payload", "value": "b12745198e77f053ae6ef34a42c163d59ddf3ab70fe570eed503d209315f6422cb152ee8f16cab981032a5d9411f87f3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mamont", "colour": "#D5B2E4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964346, "uuid": "c6631195-6084-44b9-bd3a-57236474d560", "value": "T17AE5CE8BF749592FC8B705B249AE537066538C028E87AB437C48371C6D7B6D82F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964346, "uuid": "396d48fd-318e-4a0b-8b4f-d5ef0a0f1999", "value": "49152:EEikpIzcb3vNQrfoNuijwDF0okRjWKzk79/ikT01QsgyB191d3pKyoOu:E7kp3CrAwP4LzUdMB191d3pXoOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964346, "uuid": "3cd2d703-79a5-4ab9-8cb5-28ab7c601b01", "value": 3119597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964346, "uuid": "1a68c625-59d3-4ce9-8b08-9cddfd2b69b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964346, "uuid": "eb410e00-f38f-45cb-801d-d7a3630f1626", "value": "TelegramFix.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23cc7ae-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935181, "uuid": "1cfe2863-373f-45f8-8fdb-7bbe6f506604", "comment": "Malware payload", "value": "841d3850e34a88aca23c9a2169eb1452", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935181, "uuid": "6edf6e52-201b-4ab9-a381-a90fd24d7f9e", "comment": "Malware payload", "value": "be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935181, "uuid": "149f3b51-06e2-488e-b8e4-d56961c25fff", "comment": "Malware payload", "value": "6fef105ec37841282121ba1c01c92236097aaf79", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935181, "uuid": "828f15d5-82b7-440c-82bb-cef8bae927a4", "comment": "Malware payload", "value": "b7e60969b2d287c0f61d6348d674936b8f134b96f48500abb5c43465686d08875d634d4bcb1dcef73cca53979bd4b294", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935181, "uuid": "3764495e-6ad3-49d1-a1b4-ab77501f2e10", "value": "T161D46D747E061EFF5BB8208248C6811C563836B9DA682CF56ACB0CE3391D77527B79B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935181, "uuid": "8c2443e5-a98b-4d1d-b43b-ebca914c8020", "value": "6144:pdxLufZ2iP94alri0/UDpiIfUdrMQxovLyZvnYcS09o9wLiA:/xu/+kIkMQxovug09ojA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935181, "uuid": "86cbbe38-95eb-419d-a42c-ef2b918d2a82", "value": 626243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935181, "uuid": "1be71fa8-ad33-4454-9c58-44e5d46b22cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935181, "uuid": "911a4ac6-f1d0-4f04-84f4-b55c9b7cfcff", "value": "be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1881b5f-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944736, "uuid": "ff71c5ab-4d08-4b4f-89c3-f747a50fab6b", "comment": "Malware payload", "value": "d2fed7f429404bc0e423ed6ea973e7bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944736, "uuid": "f8a4f2ad-986d-45b5-9c65-c691b43b6dcf", "comment": "Malware payload", "value": "be827f12486cfa221f1ed0bb34841f1658f084ea431ee3bbb50cee0821fa75cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944736, "uuid": "46daecd4-dccb-4be9-82a0-f26fa6e40863", "comment": "Malware payload", "value": "89240b6666679ccfa94335e56373c394dc501d9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944736, "uuid": "2f4bc428-932b-4645-9f87-e65ec137f270", "comment": "Malware payload", "value": "edab4e24c64387c4731f71b26d7457b0a570f06654562587cd6b54a7748969f651dfeeacedb5cfa001bd3e3a063e0b18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944736, "uuid": "4df5f605-2310-45a0-94b3-699a9cab88e4", "value": "T119715016DBE94127F4F60738BEB3871367B1F8908F77472E0984023AAC617A41965BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944736, "uuid": "ba60c1dc-639d-46e0-afd2-b9c0eabde575", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944736, "uuid": "c2b1104d-539e-4614-abf6-2e513923fa4c", "value": "24:etGS39Rzt31E5wd6Oyyl+q1cjkR5rastkZfg5mo/FDpWI+ycuZhN+akS2PNnq:677dkqijkR5rQJg5mgs1ul+a3Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944736, "uuid": "0ef920dd-3a4f-412a-a02d-4e0b8bac1d24", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944736, "uuid": "cbdc4042-d3f0-4120-a864-6a339bd0bf3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944736, "uuid": "d3408bca-07f9-4977-873a-78bab12db4b7", "value": "3yeua2ol.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e14c41-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926567, "uuid": "56bcb727-4025-468a-93fc-3c2aa91b8440", "comment": "Malware payload (Mirai)", "value": "d3abcf37c4316a3b9897d4e0254259eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926567, "uuid": "4f9a2d99-bb61-411d-b456-f213d87a7526", "comment": "Malware payload (Mirai)", "value": "bed31d4b0314dd737e0c524b98cab1b456d350a583cb9a9227cb843333a9d78b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926567, "uuid": "2ed0c1a8-7e35-4bff-8be7-2e57f4de57cc", "comment": "Malware payload (Mirai)", "value": "c41661a481bcee064b4cee68423db53a6c6ad057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926567, "uuid": "113b65a4-1421-44d1-93f4-421d7e7dd267", "comment": "Malware payload (Mirai)", "value": "67e7d1a3b098ca4b387288b534e433b569076431a487e2a37d5013661ed1550105b0e25855ae33194eba5830458803d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926567, "uuid": "ead46cce-2339-4cf6-b196-af9f48645e47", "value": "T1F3A2D025D349AEF4DFEF9C9452C1C2C276E987C6278AC8E340FEBF012516046BB89D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926567, "uuid": "5450e6c5-5b05-47ab-a7e1-156d8530c011", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5bjGM4uVcqgw05VxJv:mRxsSVsMD6xiJJE5zRWNr4uVcqgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926567, "uuid": "03dc4d49-7858-41c2-a94b-7940e93151fa", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926567, "uuid": "592a5975-2b78-408e-b142-5df83623fe96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926567, "uuid": "a8b7bcb3-a782-4125-8156-cc5a1e4e81d0", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b8c472-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927858, "uuid": "31d73187-3498-4cfc-8bde-3dba25caecc1", "comment": "Malware payload", "value": "a32041254c8d2a41eff13877d98bb485", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927858, "uuid": "a362f8da-051d-4365-8b6d-399a9aeb3fd1", "comment": "Malware payload", "value": "beee747d8750236ac6816c067b6d0152119078acd1c68c66356397950d9f34a2", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927858, "uuid": "3ae60b50-2cc6-471c-b02b-be6e9444f40b", "comment": "Malware payload", "value": "caa2e77501a02260998bc759013ce0bf167b49d5", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927858, "uuid": "c3c3cacd-fc04-487a-915f-b521fe8ec71f", "comment": "Malware payload", "value": "237b73471c3919fedb97ae927a5997e88e0590305b4fa52c2c4dcb6852d87e1997363be1a081b75763c7cf0e5557924d", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927858, "uuid": "65de950d-ff0a-4fa7-bef3-16badb342456", "value": "T1012723478B3A997F1FBD224D2EEF69182B93C2104B7A646771D124C6FA4BF0255270BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927858, "uuid": "0746daed-0ef7-4cf4-9199-ce39c37787ab", "value": "49152:T6fQ6fR6f56fo6fM6fi6fS6fy6fL6fQ6f46fElrxgdx6fg6fT6fd6f06frlrxgdt:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927858, "uuid": "1a846e50-10ee-4d4a-bec0-ab40b3baa518", "value": 21851510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927858, "uuid": "10c03858-6237-476a-970a-d98a0fe45f64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927858, "uuid": "998ae73d-f03e-45ac-8032-87f806f11077", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c2d9d4-3ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776922812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922812, "uuid": "5f73552a-0020-4560-8c69-2e2161b3afdd", "comment": "Malware payload", "value": "9d2eb33fe57ab03d4ae2648c92ad776d", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922812, "uuid": "217e9918-afd4-403b-b2ef-03e3f1b44157", "comment": "Malware payload", "value": "befa79d14347463317cc14d3994559a0dc3fc6a7065c45bd3f4c5d8530d1d0d7", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922812, "uuid": "83b986fd-cd17-4db4-bcee-09c04d3d6c2f", "comment": "Malware payload", "value": "b224f9cc7074b90040e6c1f74a7f99dee3b6a762", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922812, "uuid": "109e8e4c-e06e-4775-9fe4-6838b70dda91", "comment": "Malware payload", "value": "ff04bbb78d41f8b542f285220affc16ff43c578f9ae66eff4d5b3acd5a63d6c42d04ea51fe4ba2f2d4763f82dd54370e", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922812, "uuid": "3debeb23-7d17-4460-bc2a-9f1cad1b3917", "value": "T1EF0265692E53DC9202B1D647ED04420BDE73136B12991E61F4BC84415FE8D1EFA9C9BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922812, "uuid": "2f896ffa-d580-4837-bca2-7cb9ffc77990", "value": "192:/BYwS9bAz07c6MfcN7m/K+lSF+I/ZxqRxrwHldh0:/qwSNAx1w7mS+lSFF8ald+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776922812, "uuid": "f7326c43-7151-47b0-9a29-750af2639163", "value": 8284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776922812, "uuid": "e7eca151-e548-42af-a94b-51cbd95b913c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922812, "uuid": "d5a46c04-9b34-4411-98ab-efe61506b7ca", "value": "befa79d14347463317cc14d3994559a0dc3fc6a7065c45bd3f4c5d8530d1d0d7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb5f4fe-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923092, "uuid": "f18806d2-4a0c-4eaf-a45e-fe8622ca4439", "comment": "Malware payload (Mirai)", "value": "4594c99cc7866ac88a83ed7b0529f165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923092, "uuid": "306fc918-567d-43b5-affc-3edfc6a0e51c", "comment": "Malware payload (Mirai)", "value": "bf98e1e63649012d1ede90ae98a1b0585a5c3f5cfb35d7a3a913bdeca7c4220f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923092, "uuid": "41bc9dc1-1f28-4f4c-9a0d-321bdaad173e", "comment": "Malware payload (Mirai)", "value": "4494850b69086896a197452dc4e44d89ceefa47e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923092, "uuid": "1b9543fe-19f2-435c-88a7-86d5b637bb2a", "comment": "Malware payload (Mirai)", "value": "8a5d1d71044c50fe4ab8b72b926010ad9baed34e76e84809156b0df23ae96e29fcd97d00b38345558da7e922736e0468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923092, "uuid": "d2e7ff02-2cf7-4aa5-a42b-c2a3c47ca10a", "value": "T1DE63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923092, "uuid": "4a8881b3-94a0-4b74-b064-5065a6639241", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAr:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzoL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923092, "uuid": "11a50ea4-7337-43fd-813c-63930fedd41d", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923092, "uuid": "a048c47d-a116-48a0-84a6-3489ea965e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923092, "uuid": "74ee5806-502a-4476-8109-8cc6ba132e2f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5969dfe5-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972398, "uuid": "721fd99c-bd48-4faf-a57e-fc715bad1ed0", "comment": "Malware payload (Mirai)", "value": "8fb2915dee1b86c03ed12d52c8af4015", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972398, "uuid": "10579ac8-ffc6-47f3-bc47-4f6e184d01f3", "comment": "Malware payload (Mirai)", "value": "bfe8be3bbf2e578b4f50ea7dab279b241b82a1f37753e979eac0474c92fc0c86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972398, "uuid": "1cb6a77c-fb8a-4288-8df2-15d5f2e99bc8", "comment": "Malware payload (Mirai)", "value": "521a7faac8590f55ae0b997e1a93f0df577109b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972398, "uuid": "6c104f06-ca6a-4519-983e-9e138a3d6ee7", "comment": "Malware payload (Mirai)", "value": "e996375c4b6be26fe03e209a66576c4686cec34ca50721ae0b089e5f28fe704cfdbec9ae12faff243f658e4526d635ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972398, "uuid": "f885971d-6473-426e-aa1b-400b0faafc1a", "value": "T19324B60E6F228F6DF269873547B78A25975C23D627F1D685E1ACC2101F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972398, "uuid": "2ea1510b-54bc-4071-948b-bfd559226292", "value": "3072:p04tFa/iiI8vXjD7H0qAXk62ZfEyskVqPcp5DzgXojxEciee:p7tFaJIIzRAXkUkMY5AXojyciee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972398, "uuid": "7c823f3d-dfd0-49f5-8590-0b3a04dd35dd", "value": 210528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972398, "uuid": "7e16e96f-5179-43e8-a358-33d48637954c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972398, "uuid": "878ec450-07c5-43d6-9031-26b669dedcbd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8671b17-3f39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776965256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965256, "uuid": "012bcfb9-0d7e-4f51-9977-d8d0b211744c", "comment": "Malware payload (Mirai)", "value": "f44a456fd874ac8fa7f0f8c9aafe515e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965256, "uuid": "e365789a-ec11-4807-a727-0f58365897a5", "comment": "Malware payload (Mirai)", "value": "c136d407725c8772669dfbd1e5956cf820520be720470703bd4fb641dd77e97a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965256, "uuid": "f7617cdb-20c7-4390-aea6-3bc779685749", "comment": "Malware payload (Mirai)", "value": "99070401de85e6c70ecbbd7e45ce9de3a49fe1df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965256, "uuid": "6db1fdb7-0dab-4f5c-bf0c-407cae4ac667", "comment": "Malware payload (Mirai)", "value": "b90876c0eaaeaed1469e7bce109032863d87f6db78dc6855a558a075c729535bf7d0a3c0302762bf0ca909de725fb1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965256, "uuid": "05616f36-0bbf-4ba5-a2ca-675315666b83", "value": "T10B142D72944CCAC7C522167DA0E9DF7A8F3E72DA2746CD217CD051348AC7E9B790AE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965256, "uuid": "04b760d8-e920-48f9-bf08-d96ffc144096", "value": "3072:U1KUX402w5MOIHvRwUpkmlfsnHhTyb9i:AK440Y3SnHhT69i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776965256, "uuid": "eb5a915c-75ba-42e7-8f6f-69c298de03e3", "value": 194688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776965256, "uuid": "b21b7ff4-bbd5-4c68-8431-cef4ed5c1ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965256, "uuid": "d6c8233f-3e39-48d5-aac2-846568133b18", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a347e53b-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934297, "uuid": "3dd113ea-9914-4f02-bc92-dda9ea347567", "comment": "Malware payload", "value": "b4635eab8a7f368dd745b7b186a09ffc", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934297, "uuid": "6155e058-c331-46ee-8101-6db0f1a8c019", "comment": "Malware payload", "value": "c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934297, "uuid": "34d258f1-e91f-4bb0-a5be-1a1e1482af46", "comment": "Malware payload", "value": "afd37b921bb7552a9f854da5e66e61f49ecdf420", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934297, "uuid": "e54cd81b-83e3-4eac-8148-6f1d4c0c4c2f", "comment": "Malware payload", "value": "b5fc62bccb6f3cda6c6c87b741a01cd3c8b7cba8d8ac29bb41415ff61b4e07c3ce927d5d1e142814e2116134e4d57811", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934297, "uuid": "00035ba8-7f5f-416b-96bc-19b0491f2280", "value": "T14AA23B203A426EBB97AC7092C4C2D90C576C71A5CE3DACE615C798D22D0EBB617FB570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934297, "uuid": "5eaff608-8471-4444-9ae2-344e295ff773", "value": "384:LPnrUFN8vlfaqZbjWUk8xz8EdUJBC0/XQh24WBo7uqFcr8AwCPPwMX70A35ui1S7:UbkljVsJc0/0HO8ANPrhYi1S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934297, "uuid": "26bb66ee-bbe8-4b2d-8506-7a868bdb5a8b", "value": 21711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934297, "uuid": "dbd015a3-b526-418f-89f7-5023c0b332b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934297, "uuid": "5e8a41b6-9995-4a1a-b154-152e2f3b874b", "value": "c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcb90eb-3efc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776939015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776939015, "uuid": "76f931c8-096a-4a7c-8e94-99a7eb67021e", "comment": "Malware payload", "value": "7ba15e063adfe25b273f0e1bc72f6772", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776939015, "uuid": "2caa36b2-5a3a-4582-8d2e-609ee342108f", "comment": "Malware payload", "value": "c2391f3c79e77c391427488cb70aeb9d91f183674e78d278da0b37e767a48038", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776939015, "uuid": "ad5787d6-6411-4b93-ae49-d8987b11c18d", "comment": "Malware payload", "value": "d534b68dbc08cc61a9e33d2f3e029b3489e35d05", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776939015, "uuid": "84aecfb8-e43c-4ae9-81c1-0bc12089c95d", "comment": "Malware payload", "value": "b00a212633ddf5375d342f04f882e7810935e830eddb0d67115dbfa18281adb0a33c5a5f05bfbcbdfb125559df3e6814", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776939015, "uuid": "ba3e1f02-d75b-41c5-9b1f-9844c299f779", "value": "T1BC6423A0177EDAF9A91E42A707A4C71BC6B820AD39340D1E71E4005FBD4FB17A5CB4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776939015, "uuid": "9c1d4f98-53b7-456d-9646-0f706a21f671", "value": "6144:pqVW6eD9/HgSeE65pVR16ixfM5mtzikeZNly4lK928YP:p8I/mz1/M5mtzixZNlbK9LYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776939015, "uuid": "8d50b7e8-5ffa-4d04-842c-d86ddbe3518f", "value": 322724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776939015, "uuid": "241841e4-3c98-4dbe-ab93-578eaadc97d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776939015, "uuid": "31114849-c6bd-4600-b0d6-62740ea3ac3b", "value": "c2391f3c79e77c391427488cb70aeb9d91f183674e78d278da0b37e767a48038.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efcd638-3f03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776941859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941859, "uuid": "190e6f4a-f411-4635-9045-15b5e37f3a6a", "comment": "Malware payload", "value": "bbdba4f19164499b168bf3369af175ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941859, "uuid": "81d70a74-4f8f-4099-87a4-3b611e0b88b0", "comment": "Malware payload", "value": "c23f39124b525e0829cc2d75cbce2c1d70f4a8f3d0d14139549c09062ab90391", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941859, "uuid": "e8ffda23-e10c-4b74-a44d-9ab960e2fc4b", "comment": "Malware payload", "value": "120464e7ad1d6934cc410a12302a3c9ea77dcdda", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941859, "uuid": "0a4e24c4-a963-4550-b2c0-a2347285b53f", "comment": "Malware payload", "value": "c78bea3443d850b975ea03f4e44559e473bf64eba5d75ea688c8c5050651746c34a395b6f1dc5317d1ce6587eb2e946c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941859, "uuid": "013cc963-4a65-40ae-9e06-134fa64c0fc5", "value": "T1ADA56762ECC064BD034523FBCDA6A26CF93013DA6541949CA4D6FEAB16BF2350ED52F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941859, "uuid": "a9afd25d-0769-4815-afbe-79624f7ed85e", "value": "6144:pBOH964i4xiJZ5PHiUrcjxeJTaN+M0EEEAbPf343dEEEApJT1XYwmTCK4BQZkh5Q:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776941859, "uuid": "1c30eaea-5385-4660-871f-08e5f2144692", "value": 2086951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776941859, "uuid": "b9959291-fa61-461b-9bf7-7aab98c23c16", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941859, "uuid": "bf1ab997-b6db-4a52-bcde-ac228ec3095b", "value": "DOCC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65377b7-3f3f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776967910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967910, "uuid": "d01a6225-26f7-40f3-beb1-1db4929b32e9", "comment": "Malware payload (SalatStealer)", "value": "562b7772569f4f3237891258d55dbb47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967910, "uuid": "aa24d308-898d-472e-a305-c559c4a7b18c", "comment": "Malware payload (SalatStealer)", "value": "c26ba5e1973ac097fcdf459588d80d7fb0359f52732cf3dc0f60ff1ec88630d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967910, "uuid": "cce8d3d6-4725-4e3d-b1d2-21362f844346", "comment": "Malware payload (SalatStealer)", "value": "09bfa66d84d9dcbf468b8bcf9b488dd1de9b2edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776967910, "uuid": "45a3ec6f-ec7c-4251-85c1-f6e050900715", "comment": "Malware payload (SalatStealer)", "value": "e48da9bd27305899e7f4aa9358385bf9f520b7a8bcb4e7e579eb5203c1a8bfbff81c00f8d76f6b1b3b12dc6c10f8fd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967910, "uuid": "d6179b3d-f197-462c-958a-c6cfd1d951c3", "value": "T175C64A11FA8B58F5E9031831415BB23F73315E048B68DBABFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967910, "uuid": "11a4e57a-b4ca-43f5-ac8f-f26a564fc734", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967910, "uuid": "4bfda3f4-864e-4f26-bea6-7af45a6fa544", "value": "49152:gctf2jTSuk8F0Dpy9feU6d0v+2u1YsROpS2RuxjalmNI+ARH0ugcE845v2Arnt5i:p52jTZ0bdvxWh+Aipj5Tdqh6Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776967910, "uuid": "8afa4723-9d5d-4bd0-945b-c5fcdc1f81e1", "value": 11671552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776967910, "uuid": "a002c697-8a74-4e1e-9cbd-3de34b726a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776967910, "uuid": "60b61647-1cf3-431e-967f-d77ea4169d05", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121c36cd-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976144, "uuid": "21b3aca6-3a3e-48c2-87ea-b66879f57e97", "comment": "Malware payload (Mirai)", "value": "a51419ae4af3406eb59da51f0e23697d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976144, "uuid": "b3e0e57c-9b25-484f-8416-779cfa4e2363", "comment": "Malware payload (Mirai)", "value": "c2cb019ed9edecb22f05b81c2498e41cf1aaa2e35a775598a3f19f22a2e6e2fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976144, "uuid": "140d2e90-7acf-466b-90b8-00b51003b347", "comment": "Malware payload (Mirai)", "value": "d758b8fd5a4a7e0ff3668f752030fafdb7854d78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976144, "uuid": "49f69b36-fa01-42d2-96d3-d17f7cfe59dc", "comment": "Malware payload (Mirai)", "value": "8d72398f0a33dc5ad23c344c61c05d07d7a9548afb34cce2b75ffe7535153816af75ec6fef491bcc296a48372e0be99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976144, "uuid": "ea0a3440-b033-4b02-904e-4e9bcc065e5d", "value": "T181435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976144, "uuid": "7dd2109c-5f9c-4cbd-be53-2e350a3ac5b6", "value": "1536:eF6QcATQdskHosl9k1dP9tT0bI666hJa108:tqgtJHk1dPHgbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976144, "uuid": "f369ac19-62bc-45c3-934a-78496bae1fce", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976144, "uuid": "e8882ea2-0662-4941-93e9-6a7ab79766b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976144, "uuid": "29df1cb8-c66a-4e82-af11-0870178d9497", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685898aa-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923031, "uuid": "0f9cf326-78f8-490f-b0f5-6ea41ed7c76e", "comment": "Malware payload (Mirai)", "value": "6a79152066642b34163a23b44b240492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923031, "uuid": "bb4f8d3b-9639-44d8-ab17-4594004f8b0a", "comment": "Malware payload (Mirai)", "value": "c2e0a3f9731a2ba84cb35831e3c069582c436d6521a349f3b16ca621e9962938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923031, "uuid": "09fed242-eee6-4a2d-8866-9058905e9991", "comment": "Malware payload (Mirai)", "value": "961ff0d14d1849cc05cca508ff8e8e26bb9f4797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923031, "uuid": "965fb846-1bc0-44ad-984e-188c86a93506", "comment": "Malware payload (Mirai)", "value": "c5f0f652c1334f081b9b7e2b4cd7caf8f9fbd489d019a9d255ce426f994d566f8b10cef09d7e949c141010538300f46b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923031, "uuid": "d63c947d-5803-48c0-8624-c77804117853", "value": "T11EB2C0CD65443088C98D7C7C278D4A664F6CA1D0BADD9F26E354CDD8B3BEA8B3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923031, "uuid": "7a24e61e-0cf0-4213-9ba2-cbecb11a813f", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpTZqSWvj:4QlS07FUXqIYSXQKquFqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923031, "uuid": "fac42cb0-12d9-436d-ad44-6bce03d5a81d", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923031, "uuid": "b1b1a93e-25d2-486d-ba1d-3f049fc0f566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923031, "uuid": "65d7f39a-248b-4cba-90a6-e22435018633", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b97bf3-3f3c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776966251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966251, "uuid": "dad3a5ac-fafa-42b4-8092-cf28b16abaca", "comment": "Malware payload", "value": "8f517a08d813c4b3fb51a10ae0b11d5e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966251, "uuid": "c5853a47-0b7a-4337-8659-06f3d615cfae", "comment": "Malware payload", "value": "c36690194c06abf903f2f32ae7ca654b0ee10aec3733940db6eef58cb620dcf4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966251, "uuid": "6b0398e8-0433-4aa6-814f-c681f0e39518", "comment": "Malware payload", "value": "3948890e1514cd281e94016f1941e74cea71ef35", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966251, "uuid": "02a2fab4-b341-48b3-9667-9922cf37b1df", "comment": "Malware payload", "value": "f5737281d885c40e9921146674a3516a8739fce09849fbf64a03c2f8ed523fa9ead6a93ac42a2b4d29314f072e7bee45", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966251, "uuid": "cb1c4f0f-4fb4-4bf9-af54-122ed7545533", "value": "T192D301C7C97D88EC475B6869110F2D17CB4753270E2CCAA1B6EEAD843F21F7460AA9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966251, "uuid": "55a7c40e-48d6-4a15-bb0c-ee5778fb03ad", "value": "768:zaqc301iYR0XQL9tu9mvxU270pGiE9cCowc3uvbpS62ARckNkGhmj83JiUQbOCtB:OEP0XAxAfmgTH0JCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776966251, "uuid": "141bdb00-80d6-4396-9f46-a12e3c782a08", "value": 135773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776966251, "uuid": "6a0a5d8a-1451-46ea-b205-8b2ac6cacf8d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966251, "uuid": "1558eca8-e50d-42f6-9dce-d9e60ec015bc", "value": "Local_Omega_Invoice_259.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f433f05-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776985588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985588, "uuid": "8e3c3a77-8a9b-42df-9774-5807f00bdc18", "comment": "Malware payload (AgentTesla)", "value": "b1621d60065033a5c4f5eeead27687b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985588, "uuid": "2722eaef-b34a-48a4-ba01-4c5b8ddf6d7a", "comment": "Malware payload (AgentTesla)", "value": "c3c265d5e6de811313a8e3311625958c92f28a9e87f2390cbb5abac13f2e18cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985588, "uuid": "a5bf9a81-9ed4-4a14-8e10-f52003c30dd1", "comment": "Malware payload (AgentTesla)", "value": "495f544eb701650fc9d2db2f58e06771b5f81ec0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985588, "uuid": "b78ceef2-286f-4ef8-9642-15c630e215bf", "comment": "Malware payload (AgentTesla)", "value": "caf15986dbf0087841ea6d7c97f9f6be2f43acdb31977e85c10febc24c63f2f4990c5d7b74e920c38cb05b401caad734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985588, "uuid": "8b4ae7a7-131a-4788-b3ac-2d4609c4e764", "value": "T1161412982D2C9DF92A49F2B037DE721C768225AC58EED1E958C090E337D790D852BDC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985588, "uuid": "d034e6de-cf43-44c4-a445-2b0543114929", "value": "3072:TTsPZKIkwsHsNEcunIGQdKNuQMl/3BQpJXM9QNDRc91PvsEn/lvp9Ux6vyKPHHo8:T4TunIlKQdl/YxXXcjHtD8KPHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985588, "uuid": "ee4fdfd9-5aea-4fe6-ad75-ba2f13d9351e", "value": 203794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985588, "uuid": "f556eb0a-528f-4ddc-b47f-bd99b6a5dd59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985588, "uuid": "d50a6a46-7a44-459b-a72c-0c32c4441247", "value": "LESS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b02a3fd-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924351, "uuid": "25ba57ac-41e6-4eb5-8897-1d2da19b3cba", "comment": "Malware payload (Mirai)", "value": "c5e8cf509e07121a82549b108a16360b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924351, "uuid": "a9080263-5c81-4ef2-8c21-9a3a819be78c", "comment": "Malware payload (Mirai)", "value": "c3eb3129e2e726e3adb37785c3799ee79a44e51edcd3467ee305d30f596596d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924351, "uuid": "8d360b9e-eeb0-42f2-bb21-4b32e06260d1", "comment": "Malware payload (Mirai)", "value": "39c54e24c957f92466f23d9201c1a945f35ccb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924351, "uuid": "65442d33-deb0-4a26-887a-15cc0d1f05f1", "comment": "Malware payload (Mirai)", "value": "458fcd9ea95aeaddac298b69bdae0992d34f746882533c1a25c2204987c5bc8c74162698aa2c02d74a3580b751ca8cce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924351, "uuid": "54185d6b-535e-4b8b-95be-46bc1e8dd2cb", "value": "T11D833A80F987C4F5E95B083040A7F23FCF31E9699070C66DEF9ADE35DA67640931A299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924351, "uuid": "8c8743eb-1f7f-4cb1-8509-e4d7857eb62f", "value": "1536:zxe/A97rFwfBrlTjz/MGfdAlHq1aZ9G6/2jULWJGoWCQ1JJRcYPeKbzm:zxea7rFwfB5TP/fdAlTn5/2A2kX1J3Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924351, "uuid": "4f1414ae-0976-42f0-af87-915f45b7197d", "value": 83020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924351, "uuid": "d2d8a52d-18b6-4851-bda3-d8e05234fc8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924351, "uuid": "2478ac2f-693d-48b7-b47a-be0dfa0a4f69", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e68464-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934414, "uuid": "882196ad-5065-4568-9aa2-512d101d7b4c", "comment": "Malware payload", "value": "7f18add4f0b21670874940278eae728d", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934414, "uuid": "5f2eb3ad-05d4-4eff-9dfe-08ac317225f0", "comment": "Malware payload", "value": "c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934414, "uuid": "efaefc00-53a9-4227-9040-fc3de18949c6", "comment": "Malware payload", "value": "5b89c67bf6f3fe527ecd3c089baff57cb66ce4bf", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934414, "uuid": "5586b6d2-01a7-449d-b994-835b684a2038", "comment": "Malware payload", "value": "5113b526e198499b1dfe58689cfcf5f963648d15b4b1f693171db55a15c22385126c8c982202d8ccb93211ef08536c4f", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934414, "uuid": "ec889c70-f37c-4779-8f4d-c2c52616c265", "value": "T141456D307A422EFF5BA8208248CA851C563C2279C9686DE579CF4CE23F0D77527B79B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934414, "uuid": "0b846080-d291-4d54-9050-7ef258cac0d7", "value": "12288:56UCldueCWe3hLxTtxioHWMSEdqMNkzwKZUII7SvYyhs+yB4zveITUBSmQdFkvTD:4ue0T9ezFUz7hV+yEWW5mQdFGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934414, "uuid": "9dc02eab-9b88-4ec6-9765-649702d7e31b", "value": 1228847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934414, "uuid": "6a925a28-fe66-4c3d-bdf9-543414e14f38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934414, "uuid": "41cbecac-557c-4c51-9c10-7ff64f16a245", "value": "c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405cca73-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934131, "uuid": "6415b74b-305c-4f6a-a993-4097995e8129", "comment": "Malware payload", "value": "04f0ef18a152f892ef0c43aa7d1499cd", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934131, "uuid": "c339646e-cdfb-47ff-a98f-05f5fbc9da4b", "comment": "Malware payload", "value": "c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934131, "uuid": "64e8b498-98e6-4359-b5d1-a3355a74de2f", "comment": "Malware payload", "value": "3269b7c555b868bce5bae7fc7b4b8a55174ec221", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934131, "uuid": "68bd3171-203a-4d34-b782-e5978ae4a8ce", "comment": "Malware payload", "value": "93e83955d486fdb7b0ee36d6cf1ac425e495c02424fb3aa215141ab71336b9de50dfeaa771933625d7dc8aa088913eac", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934131, "uuid": "4a6cd93d-e4e4-4b52-b1c6-449a0c1361cd", "value": "T131D47E307E462EFF5BB820C248DAC51C563C36B4D9682DE569CB0CA2390D77627B79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934131, "uuid": "cbdd345b-eb04-456c-affd-3d9aee79ce16", "value": "12288:ShDm3xC9F8AD1LZe4savRYLKVsvXWAorj9qbdprQTj6r8:dYnPjUvXWAork/Tr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934131, "uuid": "d677ee17-89bf-4bf4-93c2-32a7a872b2fd", "value": 629957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934131, "uuid": "4bb3e03b-0090-429f-afa8-50444e89c059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934131, "uuid": "c39a9082-aa14-46b1-9471-d29654ac781d", "value": "c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5122284b-3f1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776953057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953057, "uuid": "7a013c2d-6801-42c4-9922-e7ff3ef22b46", "comment": "Malware payload", "value": "91cad0d00a1b928ea6b8bee6bf5d52ca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953057, "uuid": "e3eb8c97-2b27-4626-a3bc-424fc4ce38c8", "comment": "Malware payload", "value": "c511c0aa0b0b14c23ab05b71426d038eebdeeae05237a35f52c1c0ec5037700b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953057, "uuid": "b8959ce2-0df3-4d2e-a599-cffce9fe6d3d", "comment": "Malware payload", "value": "706004efd0e31135b64e1cc9ce40ac1a012662c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776953057, "uuid": "6f98a696-1acc-4bfe-9406-6652d99095bf", "comment": "Malware payload", "value": "66d459cf80abc3bf9174bc86608a746638ce3810980144a50587354966e8749ebcb1e69fc8b807f59c929a3578317d68", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953057, "uuid": "4c28be8b-ef3a-40f6-a39d-9321a466d4f5", "value": "T12C33A4FBE099A6C9CC2743688E168405BF57F0ABFD456D17445A1EBB0FAC2D1E20F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953057, "uuid": "1f49f000-1472-4c99-95f3-44f5e05830b0", "value": "768:U8RX8o7UCQjG9Jiy5wwOZe8WMUFU/fWbbI7Cmb9Lw4k:jTviy5aNbzfWbbIT9Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776953057, "uuid": "80c98641-8353-4408-a1ea-721416bbe962", "value": 50648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776953057, "uuid": "f24afa06-a031-4543-8049-568dae205682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776953057, "uuid": "c9ca239a-bc88-4e8b-a41f-0be97c57dc7a", "value": "archive0331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52673a03-3f57-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776977970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977970, "uuid": "6a318f3b-e68d-4794-bd4d-adea9c47409e", "comment": "Malware payload (Smoke Loader)", "value": "b07a03883675654088a2b56a80933ca8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977970, "uuid": "253a7a67-1354-4659-a213-32c74c0d7696", "comment": "Malware payload (Smoke Loader)", "value": "c529217014b732abbe646046c07ce8f0366a42051839d4cb3be5b400285fc728", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977970, "uuid": "5edc68f7-bf2b-4a69-98f9-36e13fc1836e", "comment": "Malware payload (Smoke Loader)", "value": "7450731c0baf5befb79966a6be7873a5b1a62a7a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776977970, "uuid": "ed0d8ed2-b933-4328-97ec-436ee12750cf", "comment": "Malware payload (Smoke Loader)", "value": "364c493f9b726659e5233149652ba615b696ed6451e42fa46e4312de1f42ed9ec10a4e171b4a7e52dee0624918dc7448", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977970, "uuid": "6d673199-e19d-4839-9f08-b4146f37c8ec", "value": "T154263333F2480A63C28650B41ED82FE955EADE05EB08CFCB96AEB5BD06757F07463950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977970, "uuid": "6e5407b0-0a0e-4774-9eed-ee032858af2e", "value": "98304:fkaa6gi5Qz50lovV5OaSkX3eZ2HqF3i7bwJtrW1W67aRBOV:/ab6OXOaPOZQqE7WrW1ORQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776977970, "uuid": "17414215-33a2-41a7-9bcc-b1d71e7fdf9f", "value": 4710400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776977970, "uuid": "d121b70a-78b5-4c4d-a27b-8b197925926e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776977970, "uuid": "3574dc7a-d569-409d-9ac3-0bda301a586f", "value": "DTYOKUEN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4dca15-3ec9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776917162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917162, "uuid": "fa6e7593-ec9d-4647-bd9f-38a3efc15469", "comment": "Malware payload (Mirai)", "value": "3b2ecd4dbba243bc685d60257584f1dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917162, "uuid": "068cc448-0590-4d88-8764-9316a4e2fbc0", "comment": "Malware payload (Mirai)", "value": "c5651c7601d57e075872b2f61cd680882b32f51cf795781c10c01c66c979b5ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917162, "uuid": "08d683c1-bf68-40e1-a359-02c6b8eff609", "comment": "Malware payload (Mirai)", "value": "5bb09de4359d9fd0d16d37e40209dfcb4323440f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776917162, "uuid": "fb60171d-37fd-412d-936f-7af520467ed1", "comment": "Malware payload (Mirai)", "value": "0a8ee247f9acfcfeabe8d9745c57a1f40d6f2bc051bd74fb1f64b846a07f50e12d21fdf3c9cc19eaa949fbfd7329cd2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917162, "uuid": "38e6bd1d-a0ea-4474-ac7e-15d50d4c068e", "value": "T14733F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917162, "uuid": "7ed39352-d05c-4bee-8228-e33c49f10c65", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHJYC0QkiuVn4P:yHlPZMEcTFZ2A1HHJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776917162, "uuid": "7619c26a-07a4-41d8-8b81-c113e9deb142", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776917162, "uuid": "a3924e02-6ab7-49d0-af7e-287eca0b6c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776917162, "uuid": "e21ee989-908c-45bb-8e3b-80aeaf8102c1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab60fb-3ef5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776935809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935809, "uuid": "3efa5e33-5263-4e64-94c3-9fe90c3fe5f6", "comment": "Malware payload (Vidar)", "value": "33eb6913163acbe845cb3b591fe43230", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935809, "uuid": "fd4017b2-daab-43cf-ae2e-3c229580c17e", "comment": "Malware payload (Vidar)", "value": "c59d891e82de655ed0887c27334d2ee6fda8776ee5871f14e287c807b8b3b934", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935809, "uuid": "a179e2d5-41bc-43df-adbe-8bb245b207d3", "comment": "Malware payload (Vidar)", "value": "e28e9fa2eca3ffd3806279523c07535c78a585da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935809, "uuid": "772cb477-e696-4b53-b63a-fe3029e18955", "comment": "Malware payload (Vidar)", "value": "3dd0c509f941dc01913c854f40159dde619798f022fa1cccdd6e775b80b72b7ed56aad9796cdb6c0a1431ad325726720", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935809, "uuid": "18f06105-bbe3-42f7-87ea-e83d9d5ec9ad", "value": "T1900723318257FC551FBD0AD4E81C3B810D983EA7A168E698FDCC6AD356CA61047BA4FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935809, "uuid": "474aef63-d82f-458a-8a1e-3f10db5b11f1", "value": "49152:dY352bH94GpxJQTevSbP2VHMPig5YHJZ/zGbFYjHJMMMJBYNyZjdG4jFA4CJXwk0:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935809, "uuid": "6408f11e-88de-49a7-8f13-2e8a933b1589", "value": 18163912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935809, "uuid": "7db2a086-b32d-4578-87aa-d7822d9cee0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935809, "uuid": "ddd01b2e-cd28-4331-816f-9a9c157f78e8", "value": "raw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62def2b3-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928176, "uuid": "be464215-8952-4653-a74f-6c400edeb157", "comment": "Malware payload", "value": "381058bf73e710ac3000d74f8385fa14", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928176, "uuid": "b3fa0730-d4aa-4980-a365-62b153dd200d", "comment": "Malware payload", "value": "c5b1f90064cf6c7fc30b6e6c77d871fea8cf7296b85667a39c18ffe7c4237ac4", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928176, "uuid": "3af1da8c-9dc2-4daa-ab55-d919f97ba7df", "comment": "Malware payload", "value": "c4586ed2f02ccc1f65a908e2240568c210ec53d5", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928176, "uuid": "402e6fcc-baaa-4758-84e1-7ad628a87fd4", "comment": "Malware payload", "value": "0d5fe9a8d4007fb0fe94bf76993417dbb4d5f8411a6ae7c830f523145d9ff9c7b39b493a2f2402802432260cc5f21693", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928176, "uuid": "eb857f67-bd1c-4217-b1c9-bd94fd08b10a", "value": "T1BD2723035B6867EFC9881ADD79D7328E105E1F4C40A47D497BCC6AFB289DB10C89B729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928176, "uuid": "4357a592-10d1-41ca-93d3-bdc5bb83e577", "value": "49152:eoSA1CudoSA1CugoSA1Cu+oSA1Cu7oSA1CupoSA1CuroSA1CuyoSA1Cu7oSA1CuA:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928176, "uuid": "ebae0f0a-b59d-4bce-8f8d-a9c29bf2b409", "value": 21611486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928176, "uuid": "a1ae2aa0-8180-4afb-a794-e17f64ad8a50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928176, "uuid": "6fd3bd45-59a9-4e44-9137-e10d7ba3a4db", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35892dbf-3f03-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1776941844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941844, "uuid": "87d1a377-9470-462f-b410-6344148981fc", "comment": "Malware payload (StrelaStealer)", "value": "9a4af3cda32ac05dc35940d1e97147ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941844, "uuid": "23a5c68a-3aa1-4ec7-9460-84c696fd3a65", "comment": "Malware payload (StrelaStealer)", "value": "c778eba8e5385b17a51bbef0e1b3c51db6dc485378c90cff1b9db7aad67c8349", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941844, "uuid": "527f3f2c-ccd2-4365-8801-f653d738e38b", "comment": "Malware payload (StrelaStealer)", "value": "735573e3e29a6255fcf335ab8a8e18020d3da8a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941844, "uuid": "b45192dc-e2ed-4e9e-8f8f-2d18cf88efd8", "comment": "Malware payload (StrelaStealer)", "value": "6d5063a4d8161934754bf6903fe96daee7ed1f3265a06881eba36b193fa9e17372e4b1da7443126088d34b9e2b7a7554", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941844, "uuid": "691021bd-b34e-4bb5-8b48-6f727e172dae", "value": "T11F543038AAEA4019B1B3EF54AEE47493E92FBB73370E985C1081034A4723945EDD573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941844, "uuid": "63205705-4fd4-42d7-b038-b1d72b8caaae", "value": "6144:uvcRH/do5f1wM2eChIdSBhgabSPKPOzaSwSVqA3EPjN6HOTM8kz6NQP/h0akOo:tRH/K5f1wM2eChIehgQSPKPOzwDYqjgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776941844, "uuid": "2fc3268e-f7f5-48dc-a882-68722883867e", "value": 296102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776941844, "uuid": "5f68fff6-c0db-4d56-952c-7465f575d9f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941844, "uuid": "1d003b0c-2196-4a56-8a00-d4baa31cae43", "value": "PO-986.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93f41f7-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927864, "uuid": "f6eec52d-eb56-4480-b02d-941d63ec3a03", "comment": "Malware payload", "value": "78cb6b8d8e262a53f642505dfe397ef1", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927864, "uuid": "84a72215-ac7f-485f-b022-9b4bee98797a", "comment": "Malware payload", "value": "c7a950e72f48a71009c663896ac43ff62fbae695c845a91725628b0963cab9a4", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927864, "uuid": "2714aad3-3a14-4637-bb4e-8c581deaa756", "comment": "Malware payload", "value": "19aa4b43c8cd051c50cb81f86e0b13d140d22515", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927864, "uuid": "2cc36e75-14e1-47ff-9e98-68f3e3114809", "comment": "Malware payload", "value": "84d5a6433022d6c0c34e4aebb84785883570c1c458ef4378e373762a30f8b7507a11d72abedd62a92233814679c9f9de", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927864, "uuid": "8bd730d7-06ef-442b-b833-d1896a098ec1", "value": "T12827234506B7DD7E8338D1AC28AF26B10ACA0ED04D14DEB937E67061D39D726778BC68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927864, "uuid": "2c3115bc-c9ad-447a-8da7-bf508cd474b8", "value": "49152:ze2STfxe2STfoe2STfDe2STfqe2STfGe2STfoe2STfne2STfwe2STfle2STfRe2S:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927864, "uuid": "f5e0655e-8b98-451b-b10c-71e9d69d62c8", "value": 21611504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927864, "uuid": "c78a4892-6558-482a-9d8c-2f0f0ab6f917", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927864, "uuid": "df0f700c-c094-4f2f-8c89-e9ec914d2c63", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6b406d-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1776930878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930878, "uuid": "f41dbada-3df7-4883-b92b-7d3f8c2d4483", "comment": "Malware payload (QuirkyLoader)", "value": "d0eef4f887692c9b5dd208fbe618a7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930878, "uuid": "e218809a-aeeb-4c55-98c3-972f646f8ffb", "comment": "Malware payload (QuirkyLoader)", "value": "c7f03e3114c8bd20596f28df5130c24b9fddb4fdddb6b3b44a43e9f74ff6b3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930878, "uuid": "2475a50d-7cb9-4758-b944-56bfaf21669d", "comment": "Malware payload (QuirkyLoader)", "value": "27519b164be949ea1aaec771301377db6ec3a317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930878, "uuid": "c199b2d2-34c7-4355-bc0b-ebd8601f3d61", "comment": "Malware payload (QuirkyLoader)", "value": "914f4bbe1db1bdae26d8424ee3092a378300897b22c5e70438f5791e84a0d2f0397c2c3f9f680c024b487b0222a0aa99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930878, "uuid": "64e2c9c6-cf63-4542-9038-76ed76feeb74", "value": "T14F65BFA5F3C866D9D567C979CB11A332D1B278234BA2B0CB1A9603091FB7FD15B3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930878, "uuid": "cdb7769a-d068-4f5a-9ed2-1b42eb23e7c5", "value": "097a9d265852d86cfc01cff658c15446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930878, "uuid": "7caef30c-13d9-4cf8-94d0-2e1e3f0c6bc4", "value": "24576:txBR9MmvabanI2bw1g/j3ADSYa3DgzEJvulVynbcY1CVOAO6amo3Wmiv002UIbsj:HBR9MmvabWYaTgzEJvukgO63Zv0FUIAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930878, "uuid": "53ee8f4e-b542-4c3b-b411-ae85e4f40430", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930878, "uuid": "91db8128-3518-4b51-97fd-ef4b09513544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930878, "uuid": "101dda39-b21f-4d9d-bba6-29f07de9b759", "value": "msedge_elf_10.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6f01ea-3ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776922446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922446, "uuid": "79e83469-b01d-4576-a528-f76a0f05245f", "comment": "Malware payload", "value": "4364edb4bb60483484a8969139824ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922446, "uuid": "369514cf-dbba-4df5-bbd9-3d53841423df", "comment": "Malware payload", "value": "c88329363ed1f2c9aef2a64b3e5b21864a78b3246a5adf73fb5a4a4b00b0168d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922446, "uuid": "5b3550a3-9bd8-4645-9582-077f18084043", "comment": "Malware payload", "value": "ac31581fef00df94911b60f349f059cef162fee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922446, "uuid": "0739a679-dda2-4047-97f3-abc95bad7428", "comment": "Malware payload", "value": "c651f42b356124675ea91e2f5a716c8c75dc4c7cbbdba8a8b7dd7193150884824781e00e68cf0c9f7c4e08d1642bf104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922446, "uuid": "d4ebaf51-2490-4325-b3e8-e6e905cc0b92", "value": "T1F3168D1BBCB95C69C09AB13484736605F674B8451B1327CB1BB0F6282F7A3F25ABDB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922446, "uuid": "76d598d0-e9c6-4462-8171-338fdfd6c657", "value": "aaefd5ffb560a82916eff055ade172de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922446, "uuid": "05cbc4f9-176b-4aa7-8349-bf1ff71f72f8", "value": "49152:thGnzDUXUSMVC9lcmJxRQWnnF5nfDBHEsZs+jjKfQcQssS+gNAKym:thov+RljJ1a+VVgNAKym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776922446, "uuid": "4de9095c-96ae-4ff3-b9f9-2e83d947e6db", "value": 4308472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776922446, "uuid": "1a5f6a96-421d-4f32-b1d2-bf83d0f6f5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922446, "uuid": "e2fd9671-1d6a-430c-88e4-4ef9f9dd4103", "value": "SecuriteInfo.com.Win64.MalwareX-gen.59384571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774aff1e-3ef6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776936370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936370, "uuid": "f27f9137-f133-43b6-8a48-d97853e36a70", "comment": "Malware payload", "value": "23b747ff9f297bf25d37ae5c92df2b30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936370, "uuid": "f3c47f43-be93-43e7-aabe-3c64b8df8d06", "comment": "Malware payload", "value": "c957c840bae1205c56c40f05342cb8da124ee7d324e800fd26f9b0dbbfd2c5d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936370, "uuid": "99e360da-26cc-429a-9a5d-38c8b5919a82", "comment": "Malware payload", "value": "970ed8b3ddedb7aff8ab80e9648071fb6ac2f4d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936370, "uuid": "d1e8a3f7-3117-430e-ba05-1ac2e2cf7d5a", "comment": "Malware payload", "value": "9958a1df709856c198ffab34b43f74f7fa63d9e6d9519dc8231c6335e6e6535ef03a61b665e4703cb168b4f2df81dc0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936370, "uuid": "5d82730b-7768-4a47-b60f-8264f68511fa", "value": "T13CD433607C4F0C45FDCB501BAEB56138A081BE827D3EA591E9CA21CDCE475EBD09B5E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936370, "uuid": "d39808ee-3bd0-4c43-a234-0f585afc5c76", "value": "12288:/r4crnqLcPQ6LImqtuVfnui31+Xr30fSkkPEhYv7pqo0:iLcPQJLuVt3Y30forjpqo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936370, "uuid": "d6f52027-ad98-4e0e-9e70-b53956fd1251", "value": 635786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936370, "uuid": "f4408b6e-7f8a-474e-8a21-23231e70a438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936370, "uuid": "954ca59f-fc0f-476d-ae39-2c03adde18b1", "value": "kru.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ec8373-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1776954162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954162, "uuid": "94f44ff3-3b5e-4685-904d-9df6aacdb177", "comment": "Malware payload (GoToResolve)", "value": "acf59c5b0a5ba29aa140bf7d37505b2d", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954162, "uuid": "e67dfa89-c8fe-4239-a548-6f2b0c3cb615", "comment": "Malware payload (GoToResolve)", "value": "c9685ffb1a81d020a6d93e0696108b38c5c4d3676a14ea290d1afa98f0373c53", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954162, "uuid": "ad46ff72-d00a-40e2-8022-19712b26bb58", "comment": "Malware payload (GoToResolve)", "value": "25c546a7ac5466adabc60ae94c86c17ee4fa2112", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954162, "uuid": "edbb5e6c-4c00-4296-9f23-923921edc674", "comment": "Malware payload (GoToResolve)", "value": "26a425b87fe07743c433f67c8c213862e1c99f8ded53dfd19dae947b202446a380572b35e25dbc2b237e2b3e1f5267ae", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954162, "uuid": "752fbf9b-6ff1-471e-9098-13bf52973935", "value": "T1544733227A82C5F6D98911F09D7CAEE9613D9C250FB184CB73DCBE597B301D22B32916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954162, "uuid": "d189de48-5f32-497a-99e4-878296950439", "value": "393216:r0/KoQ3Wn7iPEcBwjzT+NSmEBk81t9dsh6ily59SFZa2lR2wJhL9grZo62pw:A/KoQmn7G/BwjAskW1sh6WyOKSdJR9Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954162, "uuid": "035d7202-1bd3-47db-bdc4-9ae35aee10f2", "value": 24952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954162, "uuid": "36946b6c-26e7-4213-aaa1-89e530feb881", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954162, "uuid": "a0c8c78f-d177-4786-8416-5eb3fd32a180", "value": "LogMeInResolve_Unattended.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2577b0fd-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944823, "uuid": "fb0d3fa8-9e3e-430b-a3e0-05161dc8c2c2", "comment": "Malware payload", "value": "3563921f7056964b7199f64031347817", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944823, "uuid": "375669bd-fabe-41cf-8ca3-62bba2081f83", "comment": "Malware payload", "value": "c9c916b7a88a006bfb5371068842d47416e13ae1d52f7b50d9f776d44b41f6bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944823, "uuid": "ea634eb0-21ea-4fe6-a88d-a96d9ec4c95a", "comment": "Malware payload", "value": "6fd1410efe28c571cf2fda4e9529d2e0928f39c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944823, "uuid": "dc14a57c-fb26-436e-a3fb-3c84101c3cee", "comment": "Malware payload", "value": "dd64abfb68cc8741dfba30c220f42d26778c934a97738302ff6f29d38ef8a0d1502e0ceabad372c48a9da149b33c8fdd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944823, "uuid": "a37b01e5-2519-4755-9f9e-8322b5a95743", "value": "T16071520697F84567E0BB0B34AEF3874A57B5F4849F730B1E09800228BC61AB41EB1BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944823, "uuid": "3c6be2f0-044e-4a8c-92ed-e503f63dfdd4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944823, "uuid": "53698cc8-1ac7-499d-82fb-2271f5c2850c", "value": "24:etGSM9OAzEO3hviJ+3CZZyy7sGoriq+0jEyktkZfK5moHFDst2WI+ycuZhN2akSv:6ojO7sG1qNjEsJK5mSk91ul2a3Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944823, "uuid": "f316d3a7-7b2b-490c-adea-beacce863fa0", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944823, "uuid": "f6565a28-1d30-4dfe-9c76-13754d31b469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944823, "uuid": "f2592ffd-c4ee-46c0-a529-a2991f1c5d1b", "value": "usw2h313.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac797da-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776925424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925424, "uuid": "97775415-ce4c-4a50-a8c3-a8117f664d78", "comment": "Malware payload", "value": "d587390b480cd13af4a12c1a1e6e2f54", "object_relation": "md5", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925424, "uuid": "2b05e1c9-e6a2-4b6c-b2f8-79c040054f13", "comment": "Malware payload", "value": "c9f0b6b3eaf7e3a5da0d9c2f128fb3772cdac0c433f7836f606e8405cc2a2c82", "object_relation": "sha256", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925424, "uuid": "71f14a95-4342-4102-b570-9a2d446a83f0", "comment": "Malware payload", "value": "b6f59f3aecf611321ffe6a139af626820391ea34", "object_relation": "sha1", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925424, "uuid": "6e69422f-2775-4eca-b741-b3c7188a63a7", "comment": "Malware payload", "value": "6eda7bc291d88675188813ea64d01db7a96c25de8004f814e159d2e7d06180037584ce5c2be3b75b0d752fa9cfc14f2c", "object_relation": "sha3-384", "Tag": [ { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925424, "uuid": "9ecfa9a8-4915-4d09-83b5-635280e5a3aa", "value": "T10A2723298F1C6D5F0BAD760935A6070E8E91CE818C189CCE6751BCAE8DCFF55640E2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925424, "uuid": "49d8e553-ea2a-4047-a99b-ec421c34fd62", "value": "49152:Xe9te9ee96e9ge9Re9Pe9Je9Ne94e9je9ne9pScDe9Ee97e97e9we9kSc+e9re9a:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925424, "uuid": "e3b5fbba-5e04-4fc8-b925-b2a71a912c8d", "value": 22331550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925424, "uuid": "fc3bea34-53ba-448d-9490-f05e2db36a40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925424, "uuid": "337fb6fe-f2ee-4de1-93e0-ec2007a9f7b8", "value": "c9f0b6b3eaf7e3a5da0d9c2f128fb3772cdac0c433f7836f606e8405cc2a2c82.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e312e60-3f10-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1776947603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947603, "uuid": "4b8cc89f-a7f9-4b96-a021-082ec7e6c608", "comment": "Malware payload (DarkComet)", "value": "02b0ca7a20a0a519aebc21c04c77ed68", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947603, "uuid": "30cb12a0-6b4f-4c89-9844-1926735c5cd5", "comment": "Malware payload (DarkComet)", "value": "ca43b69aeecd6d78b0d80e8ea38ec2988c03152758fbff87b0a422ec26b99de3", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947603, "uuid": "72308a78-3ac3-4f31-b5a7-a8a9a4f86df7", "comment": "Malware payload (DarkComet)", "value": "4ab214955569e8c6215505be00a08c242d37d47c", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776947603, "uuid": "2f57947c-23da-4fd0-aa6e-3c82f0b71d75", "comment": "Malware payload (DarkComet)", "value": "fdf9a7faabe0d7ba454cc1245f0e303672ee121b651f41ff3522c0f2bf04edaa4e5e6c6d1802d1840c86b165c9deed0b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947603, "uuid": "5fcb639e-671a-4845-a06e-cef513dcfe78", "value": "T130F47C35F5808833D82239F89C5A91E654297E202D29764B36F63F4C4E39197FE1A2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947603, "uuid": "6f7f3748-f419-4ffb-8003-2dcc51a56dac", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947603, "uuid": "5b6c4c91-6438-491f-9cd4-178284c9967e", "value": "12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/htMsEA:mZ1xuVVjfFoynPaVBUR8f+kN10EBv+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776947603, "uuid": "827d7249-154b-4ae2-bf73-121e136a361c", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776947603, "uuid": "aea89743-3410-478b-ab05-cf592330d6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776947603, "uuid": "9829bc8c-9d83-4443-b3a2-c266364e7001", "value": "msdcsc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8010f1-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927893, "uuid": "49993d7e-2fe9-4cef-a746-7c4a1a207e8f", "comment": "Malware payload", "value": "9792652c9b6e55e647b151178c289d6c", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927893, "uuid": "ae216bba-64a9-4424-92f1-ca5166b1aceb", "comment": "Malware payload", "value": "cafef0217e8e847099ba4c55d227f59c969ef9ab44f2bd7a04daec20774fefa3", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927893, "uuid": "eb43ade6-d45a-43ab-969e-bbfe8f70955a", "comment": "Malware payload", "value": "be9739b6437cb5d6519b79919c806f4550039dc4", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927893, "uuid": "f301e040-56db-46f1-8cd9-ddc19568cbae", "comment": "Malware payload", "value": "f408a3b46c293f432c5b7540ffa8c089a5bf4932e5f566cfabcc267b3ccde444efb3de0d6af9e66cbdf80569d1aee5a0", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927893, "uuid": "31c4c8e4-2d78-4ae7-a1a4-fe5e62126bc5", "value": "T1082723468D5E5EBD5F38A02C68130D4FB1E80905C264EAFFCB8A5B84D54A91A35E733F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927893, "uuid": "a425b126-b6d9-4baf-9a49-3680986fde96", "value": "49152:+GSVGSmGSYGSiGSRGSnGSoGSEGSqGSyGSuGSdQwGS9GSgGSEGSxGSLQbGSxGSzGc:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927893, "uuid": "548cb24d-9b20-4d6e-a8f4-994b430716dd", "value": 21611508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927893, "uuid": "f3b896b9-5631-4b30-8ec8-1104d8a12b17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927893, "uuid": "37e229ae-a377-4a63-8b18-0841f249702e", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5187e88-3f44-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776969948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969948, "uuid": "5ccf42b9-a628-4522-a069-f1b15573fedd", "comment": "Malware payload", "value": "d79f47d632fbc5443baf39c6a3fe243a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969948, "uuid": "02c58977-473b-44a6-ac9a-15662469fe73", "comment": "Malware payload", "value": "cb6809137e1b06b4885552b7e8da630152783cdba50acffba31930ee09145af9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969948, "uuid": "31557af4-bccb-408d-9301-5ceb3d27b911", "comment": "Malware payload", "value": "4fc3582dd0603ce0aa947ab8afdbd640e0411406", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969948, "uuid": "60ee2dc6-c228-42e8-ad42-e176f6a04ebc", "comment": "Malware payload", "value": "a690984034410f49a45315402617f3d2dcaa0473ce02504287f11f04a6bdde04748bdb7899d270716d28a5c7c757e3ef", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969948, "uuid": "a4368b4c-957d-4d54-9aff-f16e12628e1d", "value": "T1AEC56A0278D014EEC09D763289F36691B734BC580B2667D72E95BAB83E73BD11C7670A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969948, "uuid": "c4d318ad-0e40-4ef6-8bea-8dad04703eb2", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969948, "uuid": "18df2a1f-7454-4c11-87a1-627fc08b3dcb", "value": "49152:sQftxdZA9tOhTwUCqx4MGX4wJ3lKl1mQhfF6EDyU3/s:sQF/CvMGX4wJcOgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776969948, "uuid": "aac691e0-e0eb-487c-9d98-926483decef3", "value": 2548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776969948, "uuid": "3e76c39d-f4be-4edd-b631-2af9b763c7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969948, "uuid": "62e32e42-90d0-4ab8-9c21-438a58da0a04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad892ca4-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924436, "uuid": "4049fa3f-ab50-4292-b961-bc4fc0d99b88", "comment": "Malware payload (Mirai)", "value": "969f638bca72f89611e53a1440ef6187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924436, "uuid": "9e7a8dc5-f566-4e67-939f-6c4db7ee15d9", "comment": "Malware payload (Mirai)", "value": "cca80bab4ef27cd9701b35576d4f1315181808a8c6ffca242420ee9e7a1ad9b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924436, "uuid": "f0b256f6-5031-4441-b23e-5c1c3cf0b0c9", "comment": "Malware payload (Mirai)", "value": "5744cbb01f6d737368ae8e0a8d56d085e0a21d91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924436, "uuid": "18aa00bc-4a29-4e36-a48a-8fb903cf6eec", "comment": "Malware payload (Mirai)", "value": "ec954ba2a32e0444737e40850d6464ebb0b7294a5b9512da8c661abe663ed9c68cb58ee631d2afb0dc367698b2cc4bca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924436, "uuid": "8a4c5df9-21aa-4d9b-8bd7-01885cd8fc8c", "value": "T1AC143B46EB818A13C4C61775B6AF42453323EB64D3EB73068928BFB43F8779E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924436, "uuid": "9cb73ca7-a1e0-44e4-ab8b-461cba353afc", "value": "6144:cKPdmDgolUba4/2KwDiWppMjdnHCL/K8mk3/0t3:cKgZUba4/2KwDiWp+do/jmkv0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924436, "uuid": "e4ad84e3-b51c-4d60-8e8b-6f3b040886f6", "value": 196817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924436, "uuid": "15830a8b-bb13-44e5-8736-f1d69529f9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924436, "uuid": "8f82e077-2f27-4c89-b35f-fb4dcb3543c5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fc65a1-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927968, "uuid": "b7e735a7-c181-4bef-8d80-955c26e7a296", "comment": "Malware payload", "value": "78d15d734000e84e2bb8d05f784597ab", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927968, "uuid": "948c4484-5609-4e8e-b5be-de7aae180149", "comment": "Malware payload", "value": "cd313684027d5fef8144a8e24190c24a97ab4fd90f9ae4625e7fc654a3d9828a", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927968, "uuid": "9e0ccea6-fe2b-46a5-854f-654a339c25e3", "comment": "Malware payload", "value": "7052fe7fe5d691ba2b6943db4a5fe18f1dc1c275", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927968, "uuid": "c7ab1a95-a532-4d15-95d1-26b87b2bae22", "comment": "Malware payload", "value": "1c56bd3591d59338971770baaf964ed7d6f8bca8416cd77e860ac70035d18b5a150e5c4506e866532c936379b020e80a", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927968, "uuid": "dc7fe563-040d-4ae4-9bc7-af1d99f19290", "value": "T1082723092F23FCADD2F9182D4C3129E76FB88D3C0411FDA9D6D1EC9EA6D9B562607025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927968, "uuid": "01ecda0a-613f-4d01-8266-a6d9d6416f73", "value": "49152:/7u9Om7u9Ob7u9ON7u9Ow7u9O47u9Oa7u9O37u9OK7u9O77u9OF7u9Os7u9O0F5/:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927968, "uuid": "a1607d01-615a-4c65-b909-a141acd3fefa", "value": 21371487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927968, "uuid": "ee426ab1-609e-479b-b155-02f77efee723", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927968, "uuid": "5af438b8-1c2a-4b8b-9e64-d5cf56ef4234", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd680e2-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924406, "uuid": "19644529-4e20-4fd8-8344-4987dddbfc4b", "comment": "Malware payload (Mirai)", "value": "8b47077caf9a6f1789ab942d802e7e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924406, "uuid": "86880412-3256-4d90-b79f-880c32ea92cb", "comment": "Malware payload (Mirai)", "value": "cdf7b1390e49054b60139cb38866806c619321dac16b7d680aa5902d28101cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924406, "uuid": "aada2e45-516e-4ada-8dd2-f381885d567d", "comment": "Malware payload (Mirai)", "value": "834cb7f27766a925225b58dced54804b3b9f0915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924406, "uuid": "446d3f67-f11a-4cad-9a7e-4dabbdef0a24", "comment": "Malware payload (Mirai)", "value": "7d46d548bd23d2ac673e965f7f76f4816515ddd37eba836e238efad602bd33dcb352637d6ef24524799a032adb01e16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924406, "uuid": "7c4a3d75-c675-495b-99fd-ae77473cdd85", "value": "T1CB736DCAE683D8F5FC1705702036EB335B76F53E1029DA83D7A9AA32DD82511E61636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924406, "uuid": "0451c1e5-ecc2-44be-9cc6-3c94ca0de8f9", "value": "1536:3V4mt4FjWkk/q87TiYeJ1LV4rxTyK+ZmVW8ID93S5XRP:l4mt4Fjtk/pHiGrxTWZv8Kst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924406, "uuid": "4a65d091-a62a-4535-a833-9ee40b59ac7a", "value": 74956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924406, "uuid": "8af6a2f1-6d97-4b97-94b9-aed74e4d1920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924406, "uuid": "dfba3f1c-1ebf-4464-b878-a4f03165aa1e", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054a1b70-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976122, "uuid": "3f9a025c-113c-40f5-914a-cf4050e1ff96", "comment": "Malware payload (Mirai)", "value": "121bb8b77c8f9a1017810437633d369a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976122, "uuid": "7cf95367-235a-4526-b294-cda1a08c24d7", "comment": "Malware payload (Mirai)", "value": "ce47bbfcb31b5f19cf95a9ea3d4626be76410540d025397455408986f6b3dc4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976122, "uuid": "d08790eb-fc5f-4f3c-af79-bbef96ffb69c", "comment": "Malware payload (Mirai)", "value": "57afad27a7639920a74b1c294c928e171c321d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976122, "uuid": "57432228-ec34-4fbd-a131-71f8fd83580b", "comment": "Malware payload (Mirai)", "value": "6aade2251541cc2edb7889016f9682a35ae8d0c6cd56b981a0df51db4943dd3d88d2e2fd89626a221b6fc7fb2bc5a973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976122, "uuid": "e58cf986-b484-4d49-a8fc-7b95e4cc866b", "value": "T15AE328D7F801DDF9F80AE33748574905B530BB9248525A33326738BBED3A1A91573E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976122, "uuid": "927b0715-30a3-4596-8f49-0f73d0913500", "value": "3072:DqvDvAe7PuWioM462KhtgBH0RFBm+VGjbiiLNCJ2yNJih6:DqvDv/d62KhUHABmHLxyNIh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976122, "uuid": "9fc20e38-df6a-4451-8954-9fe2f60439dd", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976122, "uuid": "9ab47638-7c22-4d55-a8d5-7011f2a2c907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976122, "uuid": "13d09c90-ba32-4dea-aa6c-f3bb300026ca", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a323265c-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776954053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954053, "uuid": "f59f8ce9-fb4b-4bc3-b9bf-4a36c1fe6199", "comment": "Malware payload", "value": "59616095a081f78634a0d29100be0691", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954053, "uuid": "ac61a14a-ba64-416c-b53f-fb07a0bcecd3", "comment": "Malware payload", "value": "ce6afcf782e5d8db38db4a06f92c99e80a4f4d38303d25da388db463e82c4881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954053, "uuid": "189c7045-7661-4bb2-aa8e-6becd2b25743", "comment": "Malware payload", "value": "b944a4b479630b239320d01aef26c2dd8375df62", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954053, "uuid": "1a053d43-5842-41c4-9b06-a63d73bd4958", "comment": "Malware payload", "value": "aa2674c1939278ac9164514479e23575d7d67744ea4930fdc1fcd7d8fa36e456cb1291bd5363c5beb86db713cbce6191", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954053, "uuid": "65731169-473c-430f-9a4d-e0dc11973c83", "value": "T180C57B02A2D502EDE077D670CA464122EAB67C41B771BADF4690B21A1F3BBF05B7DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954053, "uuid": "0cb22319-cee7-452d-9e3d-d989da96b98f", "value": "33e9f32ba13f8158e111e7fcad0f0a90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954053, "uuid": "2f3c6dc5-4d2e-43ad-81a4-0a35412b385b", "value": "49152:jMyhOlB2lOxO/lyn79yJ7OK8rhkveStZy:SEIqvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954053, "uuid": "850906c6-9b25-49b0-a258-7e39a42aab6f", "value": 2533888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954053, "uuid": "651489bd-0c74-47c6-b8f3-e32e6291f41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954053, "uuid": "4334136a-a477-422d-be6d-d29dfbf32d95", "value": "xweb_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f5691c-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776928797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928797, "uuid": "493931b0-2af8-4067-86a8-8150fef22f59", "comment": "Malware payload (Mirai)", "value": "fb28702326addace04738f75ae11905a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928797, "uuid": "fe65bc17-ac57-492d-823c-b05f912d6da2", "comment": "Malware payload (Mirai)", "value": "cebb4a9c4571177d6338cd56761b7cf1af8eb0fa0d770497541f9ee157219cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928797, "uuid": "d19db905-77cf-4706-894b-e56a79605ba6", "comment": "Malware payload (Mirai)", "value": "5cc295a163aada7bb9a8dfbd4912f9bb609606fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928797, "uuid": "e9fbfbce-9695-4d7e-80f3-01eccea8cf49", "comment": "Malware payload (Mirai)", "value": "7794b3a4711b2d01413ed8350cf4f96c4e5ca1cd9398693d4ded1b8da43a1d569e8ea0674ac92fa7b85a5629bc097f4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928797, "uuid": "f98340a9-98d9-48ed-8fe2-45ecab74185a", "value": "T1D4431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928797, "uuid": "723bb0f4-415e-42ff-9639-b405dadfecfe", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928797, "uuid": "c7dd4b0a-9eab-4c70-bfe2-f5df324ed768", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928797, "uuid": "9f2ff645-2a32-4a12-865a-f46a327a8a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928797, "uuid": "716d5797-8166-49b7-bcdc-bf7b783ba737", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda1cc1b-3f14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776949400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949400, "uuid": "69ef52c9-bda6-4b35-a17a-de9009795d44", "comment": "Malware payload", "value": "154e1a702dd011065a8e45db78ff6a85", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949400, "uuid": "2e47170e-a47b-4a6e-b6ed-21501090bbd5", "comment": "Malware payload", "value": "ced1e49aab29de3911f9e7d945a1f175dd624e37d316ecf8539742e622ba07df", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949400, "uuid": "bbee33d0-10fc-46ac-94d7-0a44d123501d", "comment": "Malware payload", "value": "34abc701a388bc0471f34d695ebb6203fd5c6eab", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949400, "uuid": "45a9cf91-8a7d-4449-b192-fc562b9f9676", "comment": "Malware payload", "value": "b3af7ad468ba2ead2823f09268277abc52a8785aaa7f9f4d1aeb5a261aa43b2c753d46fc1cc1fa9dd78d71bcd5be3ab1", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949400, "uuid": "a2beee7d-a1f8-4af8-9038-dd440e81399e", "value": "T1AE75D005E3E416B4E63BD278CBA64233E6B6B8450760AEDF0369D5152F33ED06B3A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949400, "uuid": "9299d11b-deb1-4a2d-ae86-d877cc05a645", "value": "f85d177290927e88420ed0e6e8e78e0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949400, "uuid": "df0960c2-bb61-4776-a408-c0af5e19abd1", "value": "49152:G5L+ozwvutk3fp1SazD41PDuav+vDFeYw9z74lj:bosvJ41tcDoglj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776949400, "uuid": "098b3c30-095c-4e24-81d5-c44ca717ec2c", "value": 1664198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776949400, "uuid": "6d6c73b9-8d07-4af4-acec-46c9f2696b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949400, "uuid": "cb7ac13e-6723-4241-b9af-72c167e2ff1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0126d9d8-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985564, "uuid": "ad990615-aa23-4358-b803-df119edf98c8", "comment": "Malware payload", "value": "a3a096d5778624e1d4a8fb041ab06e41", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985564, "uuid": "0df77591-63c4-414c-8460-03a357dd48e8", "comment": "Malware payload", "value": "cee304cf58a80826fcc6e4eef84de2cedde1a1cd5d71f7d8e36aa41cab18c366", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985564, "uuid": "b090c65b-2e83-4754-8c27-bf08cf75e79c", "comment": "Malware payload", "value": "58cca49ad0958a5590e046af0ab5ffbcdab99013", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985564, "uuid": "dc3c4594-3226-4973-9940-ea2994be57d4", "comment": "Malware payload", "value": "387771b599711385e003d3bf32f5f87dfe024cc836dc4852006fe685810cc16cc6f403e607b272b43bf11bb7ac1aa0d8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985564, "uuid": "d40bf7c9-d1ec-46d1-b926-8528f306343c", "value": "T1D8C08016817EC91ED96790920572550C45A4EB512534AA35DB40D888B1554907206442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985564, "uuid": "ae7cd6d7-8390-475f-a021-177ed8fca0d8", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+qaHcHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985564, "uuid": "71a5b2d6-bf34-4943-9ccc-7c098a9b74cd", "value": 159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985564, "uuid": "9a94ae41-dbee-4d10-8ea1-cd166dab1128", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985564, "uuid": "0caff063-81b8-4e60-8665-b71ce92f011c", "value": "infection.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6612126-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923135, "uuid": "3883f2b0-6842-49e9-bb9b-6bf62c9378df", "comment": "Malware payload (Mirai)", "value": "be180b3b72ab2eebcf4b6155e4958a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923135, "uuid": "4c2931f3-0cb7-479b-960c-ebb53bf8d417", "comment": "Malware payload (Mirai)", "value": "cf12f242edcaa19f3e4c4e46674a4e9b73f555564ecf41f1f7c6e82ccfe73afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923135, "uuid": "75978361-97bc-4431-83aa-693cb94e3537", "comment": "Malware payload (Mirai)", "value": "5149b394eab1a800dff3ad0daa54ec76b4eba722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923135, "uuid": "be1226ce-38b6-4554-9a15-72ec0bd339ae", "comment": "Malware payload (Mirai)", "value": "8b0d6c5d59bf3ffd38b4972dbd1e59087d7382ef07520053568b75944923931745da7cea364d818aea92a92ef07ecc78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923135, "uuid": "dd4bf9c8-d7eb-4fae-b947-30d7a57d0657", "value": "T17CF43B56F880DF62C5D0257AFA5F42A8331747B5C3DB720699189B383BD786F0B3A681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923135, "uuid": "7e332f79-b78e-4228-9356-2e30d45ccdbd", "value": "12288:aSN10AJpEl5Zbp4bntM6TwFGRAL0d5QcU1xgpQfFmheSKZu2IFejLIqG:3Yl5ZbpituzLI59UTQQ7u2IcjLIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923135, "uuid": "5b37e094-0270-4f4b-87d2-84c09d9eb30e", "value": 744376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923135, "uuid": "07233541-9092-4f84-b6c6-f5e518279839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923135, "uuid": "c519b9c7-42ce-49e5-922c-0971408693d2", "value": "svc.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d87ba07-3efb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938367, "uuid": "3eb50b25-ff67-45c5-a5e1-b3d6ee959da7", "comment": "Malware payload", "value": "f6b9d0373ad50ea7a04b5db82b4c5008", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938367, "uuid": "2aecfdca-240f-4466-8b38-5c69eeddca94", "comment": "Malware payload", "value": "cf2f5043b57f31633741b100e51943c5cb1d78043bffd7c049b81e916d470c3b", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938367, "uuid": "b77cd76c-9d3e-4cbb-b24d-b55d62ad0e07", "comment": "Malware payload", "value": "7168e943ad3146324ea5825675769a5a5f813ae9", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938367, "uuid": "95d26a45-a492-413b-9e37-e3c709fdc668", "comment": "Malware payload", "value": "e5b48818508f67362ceb8414d7200f159cddea2ac048b099eb7b6fb796a9b09b69977c459636fc031b21eeaa02d8971a", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938367, "uuid": "f50a188d-4c7d-4d2c-a5a3-1f2df91c554b", "value": "T1BCC708A3995D44F6CFB88734CA6582223B317C4497252BC73BA47628FE75BC09A7E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938367, "uuid": "13752248-6634-4a5d-870c-f6da8388c816", "value": "393216:nFqxZQ159pWjSybcfcXkH4R2nbWo3IeQD:UxZ+LpW+yrg5QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938367, "uuid": "c96f3dfb-b71a-4e25-983f-165b7ee24fe4", "value": 57946264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938367, "uuid": "4ccb257c-973c-4ab5-b922-ce5fbf6b5c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938367, "uuid": "0239bcbc-706e-436f-add2-430f7e70f67c", "value": "cf2f5043b57f31633741b100e51943c5cb1d78043bffd7c049b81e916d470c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea7fd6b-3edf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776926558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926558, "uuid": "b84d407f-6183-49aa-a457-af7d3f0367e9", "comment": "Malware payload (Mirai)", "value": "71361ab12fdb925b2fa882fc7dafc414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926558, "uuid": "5fa7f76c-b1a5-48e2-aa0e-a8603f82cd5e", "comment": "Malware payload (Mirai)", "value": "d1d86b465f0730bcda495a5e0af0aa66d92556cf14c347f44275c026474fcd66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926558, "uuid": "d5e1d0c6-dc4f-4253-aca6-87066907856d", "comment": "Malware payload (Mirai)", "value": "ccc65848c25d241456e8748ac0c052d76e95ff85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776926558, "uuid": "ca3a5ee1-9f47-4da9-aa71-0bd9fae97b80", "comment": "Malware payload (Mirai)", "value": "1ecf5eac79cb5c1bfeb1dce7c23c049aeae0fd0a5e1236abd614362e9c66bcf664dd0dd99bfdb75f7660d64f98eea279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926558, "uuid": "1ae99b6a-ef75-4a61-8e1b-3bfc0a09a65b", "value": "T11DA2D1BFE4D64957DDAAE53B011D00CA50BB5D5413A783C23FA535B389778E8F836640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926558, "uuid": "8e3e3619-fdc2-4a6e-86f5-6170e1e7d880", "value": "384:MccDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/eW7MM+v1Rpg:NMkKJFH39CBVQey7qsZoMT/7Epg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776926558, "uuid": "ce4dcdf8-ef7b-41fa-aedb-4b7a9218686a", "value": 22448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776926558, "uuid": "7c491bb2-bf0c-48ef-9ae9-0eaf5a950945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776926558, "uuid": "83d3a2c5-6d30-459b-a43f-3cd519313c90", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22628e09-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776985191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985191, "uuid": "bacb4f30-61f6-409b-9096-b163a87a3437", "comment": "Malware payload (Gafgyt)", "value": "69bb0c8eff6c016ec40cd7bbefdc2936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985191, "uuid": "959a1332-8798-43fd-9cf9-6c64a413b1a3", "comment": "Malware payload (Gafgyt)", "value": "d209b10648f75fa0573914915454788ae16add30d1586fb18533592608a9a111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985191, "uuid": "a31fee86-e571-4a75-9565-bafabce73bb7", "comment": "Malware payload (Gafgyt)", "value": "08b7d82ba3b59b404940f7a42c8bc5a9b061974b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985191, "uuid": "551e46b9-0de8-41d6-9530-894fdddbb41b", "comment": "Malware payload (Gafgyt)", "value": "6ce75bb44c8d59ac8414145bb19563ea25272aa94734453c3d6db4fbcf4cc4ba3a9f778193e4027597712ff0de3ee64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985191, "uuid": "31107416-b6b4-47d7-8f74-4b65ec4ee368", "value": "T176A30B49E9519B1AC2D231FAFB8D518E33271FB8D3DE312699307FA023F16E60939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985191, "uuid": "d079bd09-2684-4a83-a759-a4262a23a585", "value": "1536:CQncq9kscBx9fvMNaMjwOaRfzy/ZnVehfd2iKPFxC0ovz5CYEdZXu:iTB7kEMj7aRLo1PFxHoboHZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985191, "uuid": "47621110-c307-485b-bf10-20acea113376", "value": 99532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985191, "uuid": "b413936e-c363-4279-8874-c2a517db7a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985191, "uuid": "b9058065-1a26-4588-8c8a-5ca98f010133", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b753796-3f16-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776950068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950068, "uuid": "c83dd101-7ab4-4544-b74c-9e08ad762434", "comment": "Malware payload (AgentTesla)", "value": "9f2ed4ff8c2589bd63c1a5991750ea53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950068, "uuid": "f387e083-6772-49ac-8f1c-29bf9981192f", "comment": "Malware payload (AgentTesla)", "value": "d2bbb4a1976cda4875e34682da19d64d1e54a5042cd79ddbf92e3da931d8ce28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950068, "uuid": "bb553cfa-e347-4f2c-bb84-5f31c09e545e", "comment": "Malware payload (AgentTesla)", "value": "6e2e786a753201c81891469c68285bb51d613a67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776950068, "uuid": "a0a5ba13-03f9-498e-bf3d-5cad4a490988", "comment": "Malware payload (AgentTesla)", "value": "3aa2dc7c7e712e24424e1968649a4a345d60f8dadc8a4bbaefe7163e2b3aed146d1668e29e9179d4b60a668afef1c753", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950068, "uuid": "f20cb99b-d93c-4bfb-b1d4-caf285d7f779", "value": "T1A825CF21AF476F99E4790B3DC1620468B3F0D8038366D65B7FF840FA5D96F89CA2B491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950068, "uuid": "a7e104f1-5344-4bdf-a939-e4b2ff890b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950068, "uuid": "0583965f-368d-4257-a406-a3d06ce3c557", "value": "12288:inNf+Pj5ZxMXO+MriwQUaYeP4SQG/gbkNEQCvoGFvQGtYBPph/d:inxs1oHMm38ePPjHEQCvoGFZYBP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776950068, "uuid": "a55a9359-41b4-46a2-bc5d-df993fdac210", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776950068, "uuid": "2a6f8e05-4955-4711-9bf7-ab363d334af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776950068, "uuid": "410f54da-5e47-49a5-9d33-68d4bd63d0c1", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca7be35-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976135, "uuid": "781c2399-fa47-47a6-8cc2-89fc68aa248b", "comment": "Malware payload (Mirai)", "value": "80a3b1d853bd3e7bbc72c40db9a0d658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976135, "uuid": "4c5c909f-7841-4cf3-b2d6-abef8e140ef4", "comment": "Malware payload (Mirai)", "value": "d3c8aff7edf6d6aa0c46275d589a786a2de173fd69f71f9caa1117e119b730ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976135, "uuid": "e5c3b728-3319-4191-a118-c4009be6a966", "comment": "Malware payload (Mirai)", "value": "608a684a7f5601254cab7fdeb24d28bef0ac6e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976135, "uuid": "2f5d2616-7d01-413d-acc0-cf695604829c", "comment": "Malware payload (Mirai)", "value": "5966ce97fcc8b2de1016331b9a3e812cbe051a563cbe1d346e7af751693c2363e01f458131d4419b3245dde5ccfd15cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976135, "uuid": "3d4df10f-b0f5-43a9-ada0-7129dd283d5f", "value": "T10D032C17F3692A17C0D0127F10FF4B16A9992BC429D0D65F7E360E6A5E727002E1AEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976135, "uuid": "f75acaeb-2c3a-4e14-ab5a-4d642ef36d9f", "value": "768:KfzHhqR2P3mvfMe9IXE2w8qhB7Es65YoQoEQFrLfzIKXoA:KfzHhCGqMe9IXcVN65Y0XrLzVXoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976135, "uuid": "a293b0c1-d00a-4550-a694-7de3f1503b3e", "value": 40000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976135, "uuid": "60b9a8ff-99a2-4ecb-81b8-e4d3672a43b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976135, "uuid": "f0efcd82-7758-4a3c-9611-4424af7ef838", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22819ab-3f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (RodexRMM)", "timestamp": 1776954105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954105, "uuid": "207912dc-d7e5-4922-9a45-64c0e284499e", "comment": "Malware payload (RodexRMM)", "value": "fe78e05a5c53b10eaba810625a10f938", "object_relation": "md5", "Tag": [ { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954105, "uuid": "a26a6d45-edc6-4318-9e3b-65dbc7b289fe", "comment": "Malware payload (RodexRMM)", "value": "d4026d7f2d49ff7dda82b5df23ce8600380247fb02da756e21188f3e1bcdcb50", "object_relation": "sha256", "Tag": [ { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954105, "uuid": "66077319-d17c-48fe-91ee-a86889593d1a", "comment": "Malware payload (RodexRMM)", "value": "7c766be12749c1dfe33717bf7352697a123991d6", "object_relation": "sha1", "Tag": [ { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776954105, "uuid": "5182285f-c2f7-4fbd-bf66-2e7943909d6b", "comment": "Malware payload (RodexRMM)", "value": "53bec394d4c8cfa41ccffcc6d43bf80f486b082a5bcaa34eeef8c528e85dd441cbc71af9f71cc2193977219275116d7b", "object_relation": "sha3-384", "Tag": [ { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954105, "uuid": "22ca3094-6819-494c-abd5-7bd1f3823058", "value": "T1BEB1B70F6D07F5715936CE994637BC2CDA919023C85164443A9CC8C69F70E3CCEA55EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954105, "uuid": "d644fc60-0fbf-4d40-9564-da7425751a4d", "value": "96:JmYHiT0IxAlT8eBEscOcml/2OltnF7xhyzZtJI/C/MhSRfAHitkNxdKswQcANK7+:JmYHiT0IDeBENOHl/2O97xhyJI/C/qxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776954105, "uuid": "c20af467-8cfb-4bc1-abad-1df91b6bdda1", "value": 5413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776954105, "uuid": "6c6e7ca0-5ca8-42c3-a2da-aa58d2bd0143", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776954105, "uuid": "65d0fe87-fd3e-4c8c-bdb6-55e8075ce1ec", "value": "HIRNBCKSTABAUGmbH-Install-Default.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5873d938-3f26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776956935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956935, "uuid": "11b693ae-225e-43a3-8c99-f235d431d64f", "comment": "Malware payload", "value": "1e8ae207a723fcf1e538977b13bee2e4", "object_relation": "md5", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956935, "uuid": "192129b2-e83d-4103-8317-57e03a866c14", "comment": "Malware payload", "value": "d42b8cdfd2b7c9800973e39361d46864b282d3e2285d7dd98a755cca97c28cdf", "object_relation": "sha256", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956935, "uuid": "e2020980-0aa0-4f98-8120-082f19b34941", "comment": "Malware payload", "value": "c5d710c493b149ce3a923c696c4b8d8a76e46c2a", "object_relation": "sha1", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776956935, "uuid": "4c91d467-fad7-4b01-a4eb-33e734cdac5b", "comment": "Malware payload", "value": "1197fc397bf47a31c94f637bae5af39ac381cd25d868ef4f40d715322348a35a8779b496c3b32358e3254c1a96d9fe29", "object_relation": "sha3-384", "Tag": [ { "name": "arrayhouse-org", "colour": "#30F992", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956935, "uuid": "9b9c6cc1-d884-4cba-82db-2c10580bb4c7", "value": "T166341A227055D031D65262F21965AFF297DDAD304FF288EB67C06F7BCA202C17925E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956935, "uuid": "a22f7e87-c837-4997-826d-45f3d0987f1b", "value": "0687f4267a8a639386af9c923f9cf3a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956935, "uuid": "32b991af-0e8b-4658-800c-5cbc823f104e", "value": "3072:Gdp1Q1isY2QisPLj/UWv5KYEy0AMmr8TqK9O2tCRlSrYdx1YK8oPaIByjzg937Jm:GWe5LD5j0AMm4WK9rMRM0dEiaQLBr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776956935, "uuid": "b9fca0ed-1d22-4bcf-95fe-8f6b81462018", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776956935, "uuid": "ed79e5b6-842b-46d8-9d5b-cc01ce9436e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776956935, "uuid": "62c468c5-8365-4ed0-83a3-a6cd1d710b7e", "value": "d42b8cdfd2b7c9800973e39361d46864b282d3e2285d7dd98a755cca97c28cdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed7d777-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987601, "uuid": "d9905fa3-c3d2-41b5-827f-543b14fea3a4", "comment": "Malware payload", "value": "325f0d85015ee43a068424423b7e35a7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987601, "uuid": "82894743-ccbf-4d07-b3ef-4523f4f5ccdc", "comment": "Malware payload", "value": "d4a21b182b96a4c7ab1df488ba11b8b18f7f49de9e36deefe112a5e63a6d6d54", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987601, "uuid": "9ae081c9-0f2a-4732-8370-c9bea168d5a9", "comment": "Malware payload", "value": "70a9e60d2aedf78ef1291e541467502eaa3d124e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987601, "uuid": "d400201a-0c4d-4f15-b01f-7690312c61da", "comment": "Malware payload", "value": "49f1671caebbf9cc8bc84a1bb17de7b5770f67a4cbe0d9ba8a7524f6ec7b1a247924fb3e2dd0110cb93827e7d7b532d0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987601, "uuid": "7e682c0d-4859-4985-bb8b-6aec9bf57c0b", "value": "T1C3C08C07210E8FB81901A0E622B877CD801B48DE2E4DE3E00282485A4192A38AA1BBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987601, "uuid": "5c7bc67f-0381-4a9d-a467-831bebbf942b", "value": "3:2EKDDVNGvTT0yq9L2RqhkJov2BKcKZGbZkREIxKkZBktKcKZG1IkVViE2J5xAIAH:0CHk9L2Skm+CZGiRxbZKOZG1Bn23fAzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987601, "uuid": "03c307b8-6a36-4990-a5cf-894c74ed94ff", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987601, "uuid": "1c74ce32-f9b0-4e57-bb3a-17f87d2c4fb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987601, "uuid": "40c57f9e-495c-49a0-aab1-1d0c968cdf91", "value": "sNqCVjenZBqV.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9092564a-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776934265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934265, "uuid": "bdf5ec84-98bb-444b-8c6c-4b6bb11389ab", "comment": "Malware payload (Amadey)", "value": "1e93a4d0cd65882a41e0bd386c86e591", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934265, "uuid": "20a133e7-4f8c-4d44-a374-a2f2bd0f125d", "comment": "Malware payload (Amadey)", "value": "d4b1c7d67b8b6d7fc996a4196990731605aa182f8ed4897b1d73088dcc63f606", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934265, "uuid": "10b82ca2-97d4-4c96-92df-b0375d81e64a", "comment": "Malware payload (Amadey)", "value": "2757f19ac627f55ebd50184f68f1c9c0b7714798", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934265, "uuid": "136b1555-bc4a-4fea-bc63-0bd8db198ce0", "comment": "Malware payload (Amadey)", "value": "eb1f16dafbf4b27aa9f10c2623725907e57a729a36d050bb70ce2f9db31a3f2d4f3f91827a1bde4831d2efe44bfd8114", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934265, "uuid": "6c164d22-1835-4c7a-9d46-8d5ed039020c", "value": "T1792413821C7DB71ED24313BB91DC6D5AB2DE382CD82745B9D98E54F7E040312BA92E68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934265, "uuid": "695f4b94-3c0f-4628-bd8f-12c68cffcb47", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934265, "uuid": "3bb5969a-4327-45fb-955e-dff705d7a58b", "value": "3072:JvjGpoEgTm834eK5cbmB4sIA2hcfDaZs0YTKblpnhHhLxayvEfgcomFr7Z5EEUik:ZjGKEgvK5rBdmMDaZPTbJHhEyRNm1X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934265, "uuid": "453ca372-ed01-4616-9fef-6d9d1ef4862a", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934265, "uuid": "ff0e86cf-e8c7-4291-a3b4-800101a4e994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934265, "uuid": "79cadebf-7167-4d78-9337-7b7badc46637", "value": "d4b1c7d67b8b6d7fc996a4196990731605aa182f8ed48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9319e774-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1776930834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930834, "uuid": "66678865-fbd9-44fb-9d4f-7fd5c5d8c368", "comment": "Malware payload (MeshAgent)", "value": "019218c42032d937b3537faa84f77158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930834, "uuid": "56e184c3-45d5-4783-a058-8e0dd79c9f59", "comment": "Malware payload (MeshAgent)", "value": "d4f85f120a35332365566647b38b56090c6e89d52209fbf36f8aeeb1a05b9b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930834, "uuid": "5c6feddd-d855-477a-acbd-3bc371a1e11f", "comment": "Malware payload (MeshAgent)", "value": "5392ff07e26da559cae7d4d7003d7e6f89902959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930834, "uuid": "a42525a7-356c-4f5d-8e79-5624d9d61395", "comment": "Malware payload (MeshAgent)", "value": "a2d5a3d1a9b07ae18ffeb10d532414b595f967b07e97fb4367e900e8658ebf7178c4e4a521c34dcf9f4e239f9ff13bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "PACN-TECNOLOGIA-E-SOFTWARE-LTDA", "colour": "#C53C53", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930834, "uuid": "8ae02f18-16d6-4215-b2cb-e23222a7ba7e", "value": "T12AF57DD2A3A600E8E977F23C85568517E7F2B81753709BCF16A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930834, "uuid": "2e4f3b41-c902-4562-968d-319b1df27292", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930834, "uuid": "eca39faf-2efd-4f85-91c3-feb3951b589f", "value": "49152:QdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5b:kHvfGfZvZj1/N/z/owJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930834, "uuid": "b98f7143-bf2e-4646-8997-edf3c08a91ef", "value": 3450368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930834, "uuid": "e454f6a1-d28c-43b9-9e06-65ba58560115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930834, "uuid": "2f1683e8-f14b-434a-a80d-ca3145675b5e", "value": "d4f85f120a35332365566647b38b56090c6e89d52209fbf36f8aeeb1a05b9b77.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdc9ade-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924461, "uuid": "7ae332f2-dacd-438c-897e-0095e0e4d6a0", "comment": "Malware payload (Mirai)", "value": "86a969b6fd2b8a1f31c3d4ce491a7cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924461, "uuid": "4660dd64-1ae4-4d4f-85eb-60efd3b720d9", "comment": "Malware payload (Mirai)", "value": "d60d73d0751958c86cb56b46fadc0dec8d979c56e4521cf0ba19695c9932e008", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924461, "uuid": "8e30e74a-3e28-4dc8-ada8-a9bcbb2054cd", "comment": "Malware payload (Mirai)", "value": "c603e0c91e242d148f0dd2aef32fa7f497e8cf0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924461, "uuid": "da3d06e2-ff74-4741-973b-15eb2685a996", "comment": "Malware payload (Mirai)", "value": "1232ead2120cb83ebfd71928dce79b05ea3530f01e90ef61d6a6d59410350e73711747b2bf14c7564da17eee2189815e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924461, "uuid": "e73e7279-7d48-40cd-b276-737d7c0d4f48", "value": "T1BDF43A69BC419795D6D02ABEFF6E838973131B7CE3EF7102DD045B253BDA85A0E2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924461, "uuid": "5f850805-fc77-451f-9c4c-20118d7c962b", "value": "12288:91YPz/fS1kjvj00xUCV9+zq5YXddstCiuIspSh6bzavGo/WsBkuIdjr4dBXlyKcP:wYezMI6v/oep7sXl+ZKNnMoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924461, "uuid": "d1eeece8-f0a2-4f9a-bcc3-5e27c1331531", "value": 774080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924461, "uuid": "7d4d4ca0-5b15-45cd-b444-5484b71ed48c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924461, "uuid": "1f01844b-3970-4df3-8124-214c41f0a2f3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50762ca-3f4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776973894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776973894, "uuid": "d9d00001-65b9-4368-a6d7-b70d704914f3", "comment": "Malware payload", "value": "d3b4347e8e00d85368532901243e9ef9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DeskRAT", "colour": "#7C3B0F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776973894, "uuid": "e428d29b-41c8-457d-9fea-7e28dc207a8e", "comment": "Malware payload", "value": "d62ad76a9841e710ce783c4f8313f134a1e6a726eb5b441b9cd49c7ae14b251a", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DeskRAT", "colour": "#7C3B0F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776973894, "uuid": "a824fa4c-5dfd-42a0-8a72-068c399af597", "comment": "Malware payload", "value": "e7f1e5c9daec683279ec8c752a90821dc2411bf6", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DeskRAT", "colour": "#7C3B0F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776973894, "uuid": "0e6f4576-fc54-4ce6-b47b-716676e2a318", "comment": "Malware payload", "value": "5d051825bf3b69f2d185cc43df83d82b79b7ac9cda5ac53fb7245d3a72a393a1a0d40c0a520f385fac79190a30188c25", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DeskRAT", "colour": "#7C3B0F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776973894, "uuid": "1a699464-d0f9-44c8-8ac1-2fc858b06ddd", "value": "T103565C07EC9565E5C1EEE63486669253BA717C496B3123D33B60F7382F72BC0AA78350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776973894, "uuid": "0fe72fc2-ce70-4069-b744-17aa4ae940aa", "value": "49152:gM+B+XVB7KQrvTZfRRp+g5Rz1p873rAUaJ3dRukzgd4ZEJC2G9Yn9nPKOKDKfwSS:gnoj2y1oGpnBJtJTEnd2TE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776973894, "uuid": "19e34db8-4dda-4c76-9005-76aef839f9ba", "value": 6254776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776973894, "uuid": "f60d7e80-c041-4092-88c4-b0a6e3deb623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776973894, "uuid": "eba3fad4-166e-4813-93fc-754e2523f500", "value": "aofJJW-68b329da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a766ba5-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776929504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929504, "uuid": "f2cb4013-4d79-4bb7-a2cf-2ef48a3966f5", "comment": "Malware payload (Koadic)", "value": "c8afbf6ad24394ad955784a218c23a0c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929504, "uuid": "fa5d1c5b-90c4-4683-9d52-409b5916dfd1", "comment": "Malware payload (Koadic)", "value": "d691b19f562b8f33b2ce91ca0aefdc2f84377e0a6a8f05223f4264185f0c0421", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929504, "uuid": "6f44df0b-0bd5-483c-8313-a3ab41c48d0b", "comment": "Malware payload (Koadic)", "value": "e268db2cb06dd54b572a94b835ee997a24cad1b0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929504, "uuid": "13dd55de-ed1a-4d96-9778-4ba61c978c26", "comment": "Malware payload (Koadic)", "value": "547dea932ad414036b551107e3230868e1ee8af8cb7058221460d95a76fee9fb0880cb0cdc4a379c7e0400c783740fed", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929504, "uuid": "174b483a-24b6-4650-810c-aea429af59d5", "value": "T1B0C19E2FFAE7338B6736C8D650B7CB24B28FBE7F5C2558669080212E19D6C5D2889740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929504, "uuid": "0dd03300-6699-45e9-a636-227fae832d46", "value": "96:8XEJ+met9m2KHBIP+2xL+Y9gFVnf2bM4SFHRXi2o7b1t9XugnK:T9Ffamd6SD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929504, "uuid": "48c76543-19f7-433c-aa11-a30a4994fd40", "value": 5689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929504, "uuid": "676cae58-d57a-4d12-9ce7-ef72089c1207", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929504, "uuid": "c35fc0a8-0635-4190-aa6e-bfa13252d682", "value": "CTM_DENOMINATION_25000_USD_BREAKDOWN.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc0af83-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776928600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928600, "uuid": "aeaec60e-daed-4f63-8a50-cdd800314e81", "comment": "Malware payload (Phorpiex)", "value": "d0966754e1216336b37c5785625e40ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928600, "uuid": "d65b0e3e-219f-478f-b806-7d48c3f2115d", "comment": "Malware payload (Phorpiex)", "value": "d6930965b838344ccb783fa697f76f1ffdb42939e4b084f169503d8540144cb4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928600, "uuid": "d868f71a-d1bd-454c-a8ee-304641cb952e", "comment": "Malware payload (Phorpiex)", "value": "73ef6b905b9ea354cad07e0bd2ae83de9f330589", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928600, "uuid": "e05528aa-e552-497c-b376-f1176b80f542", "comment": "Malware payload (Phorpiex)", "value": "636720f5a686da50ecb1c0175fd61566cadc39fc250c7170ae317f719bb572e51994dce49e1918ca8fe4e9c33c7eb4ac", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928600, "uuid": "446ac509-e29c-4399-86a3-237916ffc85b", "value": "T1A3824B0FB9424216E0D200B49672867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928600, "uuid": "26b85ee6-9d80-41f3-8813-dad1d0a41612", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928600, "uuid": "58c6ca9f-52d5-4d47-8af2-9354eaef49af", "value": "384:6I78VGQic1Kwzw077u9NHuagBhav8U9cu:fAo0769uha0U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928600, "uuid": "761f335a-85d2-4c65-9ea6-9bd5159b8535", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928600, "uuid": "6958e104-2e87-4c70-84df-0c0392615f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928600, "uuid": "489a0b03-fb4b-414c-8d89-1510eb5450ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451fdf7a-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972364, "uuid": "2ad951f5-ac20-4fee-9dc3-fff6a4de5e36", "comment": "Malware payload (Mirai)", "value": "e0a70e2d0f3489ec03afb2a22bde67a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972364, "uuid": "75f5a299-4cbd-4209-9864-4bfc70136e47", "comment": "Malware payload (Mirai)", "value": "d69646fd3d22c5fa656d78976af064b3829ff3d62b9e8e664db96d8c1093fd6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972364, "uuid": "b6f4cb2d-c14e-49c4-ab59-006540adf84b", "comment": "Malware payload (Mirai)", "value": "d5266ed0728c01d753d6ce05f867b3969bec85ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972364, "uuid": "cc7bee92-d58c-4cd8-9e68-d3dbb50a8cae", "comment": "Malware payload (Mirai)", "value": "640d8e70d29c7eb00e67c5dfe0767d44bc5bf8a324bb1caff5e280f1ffa30b532483aa1cd3d9ae2502b906e52550f216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972364, "uuid": "e696e833-e8ba-47bc-ab40-1522064255c7", "value": "T199B34A84F64FD0F2E94625B52137A7368732FD3A003DDA53D3A9EA32AC93510DA1A35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972364, "uuid": "9573925f-a641-4a9f-9274-597a47243344", "value": "1536:ao/Gy+rpPSZj6wjP2Lny2xuW7ssStWidvlWsXUJBCM+fhASiPlNFAY:auGFrpS6wqJxn7ssQ/vl1UvC79+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972364, "uuid": "2c6de64c-7394-4f6c-a871-38c06c73059a", "value": 116908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972364, "uuid": "abab39ef-919d-4d2b-9934-7995718a9569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972364, "uuid": "4a8af052-b5b8-4973-99bc-fd3807f46b93", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282b768d-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985630, "uuid": "4b685856-ab09-46cd-8d1e-2c504ad4ebac", "comment": "Malware payload", "value": "16db9f9ff9f7b8df0fc3244651530465", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985630, "uuid": "32a292c6-91dc-459a-ad9c-bc150309a75d", "comment": "Malware payload", "value": "d6c8b7a5147e32e36982fa21c4fcf9e14e415f50f16b725e488226956a1a3e33", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985630, "uuid": "d64a3239-ad59-4d6b-bd47-aa5bff96e04f", "comment": "Malware payload", "value": "0794e8b54834097d336f0f41cf60247d67e7cac2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985630, "uuid": "8de119e4-d2af-47ed-a0a6-8c93c81e54f3", "comment": "Malware payload", "value": "a8d722de754210cfe2ac06ceb7448e88b967fa27d7ff14f6ec8dc1fccd8ac4bace1b2998d7306ba1d496434cff308ec5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985630, "uuid": "e2c66349-3f36-4657-8efd-5a5ca1943172", "value": "T10A0533C27FDF3DC8057C4B59A46B5F1E0A73949128AE37B6AE926139CB067F0402E15E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985630, "uuid": "1fd225a3-5588-479c-8ab7-456adc7f60f0", "value": "12288:wPPzeATS02+R1KRhggg1hQLBCCwAtuX2uozB4FKmBEq/OcUNQBC4D/AENKPQL2a5:KBc+R2O1R3aBm3/O/QBC4D/AyK4L2Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985630, "uuid": "ce61e626-3f01-4063-a318-692dae8953bf", "value": 858511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985630, "uuid": "2a19904d-aa3f-4819-aee4-dfbdaf8bca0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985630, "uuid": "bd4ad153-9e7b-44c6-beda-20d11975cf61", "value": "presidential.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7437e8f5-3ef0-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776933788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933788, "uuid": "99bc1d31-5e78-482b-9f43-cfe04dc97899", "comment": "Malware payload (CoinMiner)", "value": "4db0c13dbd77c988666490be9537cbe7", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933788, "uuid": "9522f8be-bcc2-48f1-8051-d4339aff51d6", "comment": "Malware payload (CoinMiner)", "value": "d7b07f336bef5558b796b7de2418a67091b144f6bf09916aa3bd6c4e3695ad4e", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933788, "uuid": "52517364-12b6-41d6-a739-e02487cfd373", "comment": "Malware payload (CoinMiner)", "value": "3c8c4a8c7ea6aa0a1279f8fcefa7b58c678efadd", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933788, "uuid": "7b215f3f-e5e5-4e79-824b-b1e36befbf0a", "comment": "Malware payload (CoinMiner)", "value": "677507a13febfff74c2c78f757ff7496507b011b0e88c24df75815296c17542e77b2a4c401532a16ae1c31a4e44c376b", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8799005508", "colour": "#F0BCBF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933788, "uuid": "fa1e366e-ff70-45e3-bbbc-a3b58cd3557b", "value": "T1CD465B217B5A99ACC05AC47483878A725A3170CF0B35B9FF45C492783FAAAF55F3C258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933788, "uuid": "c66153d3-6b68-4601-872b-8fac499fadb2", "value": "b6c31122aa5e0657999f2694ab79bf7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933788, "uuid": "4bae00a6-e622-4d21-aa91-f7af7d8f1a41", "value": "49152:UPOCtJk2x8H58oepGMVBtU/QjCHOSSrRmRqUW+e1L+vrerU4oqmbkPAdf9BRvPBk:Cg5idRhr3R+OvPA59BR3B0ab+gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933788, "uuid": "717d924f-7125-4ca7-95c6-9e2e83459901", "value": 5580800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933788, "uuid": "95995569-671f-48b0-b958-bfa48d823a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933788, "uuid": "94c38eef-cee4-4398-9439-bd099249d0a0", "value": "GitHubDesktopSetup-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47a8774-3f54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976846, "uuid": "baed78ce-092e-4844-a074-d8a6284eb8c2", "comment": "Malware payload (Mirai)", "value": "60055461bc85e2f2f97ca63cf7498ebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976846, "uuid": "312478ef-3285-4ac7-a0ab-e91793dd5618", "comment": "Malware payload (Mirai)", "value": "d851e88253567b32318d7f3e91c7c9cc890be0990b661a50fff6ad3811977049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976846, "uuid": "88113195-02a6-4aa8-8c8a-a5f8c9ba1e5a", "comment": "Malware payload (Mirai)", "value": "00c9baf83765c37d09a8e08cf6f93c2329150d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976846, "uuid": "45524e2c-3323-45d2-a342-0bc2c9ddf3e1", "comment": "Malware payload (Mirai)", "value": "0437f8cbe91b0c65247b7001588cb2e8596699c714632e7135c9a1381eb80bf3017adb5438df09980892d207089fa73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976846, "uuid": "e2841018-1ef6-4bef-b1db-4325b0b0462c", "value": "T1AEB37DC8A243C0F2D45701F1613BE77B6A32D5B96119EE86E378D931ACD3842E626B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976846, "uuid": "1c7aa491-4a5a-4f9f-90bd-4ff872c755e2", "value": "1536:x6+jOEvzgu7MmBlHT8QufpLXwf5dx0ldnuOsEZTsukaWHNSrMJMIL7mcY:xQEbPMmBdjufpLAf5P4dntsEZIuYkf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976846, "uuid": "95960b39-9878-4e96-bb0e-fa54b3e1c498", "value": 108936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976846, "uuid": "c9387748-45b6-4b1a-8a71-2630dd584815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976846, "uuid": "2564cf2b-dad8-4d52-8c47-6caba400826a", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2217f88e-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924202, "uuid": "e455d84e-50f7-4608-a1e7-46376b215f39", "comment": "Malware payload", "value": "bb619a4f2adb37e1e8a4aac2fa3b0c67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924202, "uuid": "51c51d3d-c9f8-452e-aefe-03fd5b3656fa", "comment": "Malware payload", "value": "d8746ea25efc80ae0088dae481c1b923b44981cdc95c649981349f8895768176", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924202, "uuid": "433e21b3-1044-4d07-9c0b-7ceede6abcff", "comment": "Malware payload", "value": "889fca1ca4631b4983458879257879279b516a7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924202, "uuid": "bf669197-500e-4eb1-aa88-65df7ef206f0", "comment": "Malware payload", "value": "e21bff62ccb2c0efd53d9e6a9071f94d4ef42ed742f7f64a42f1677dc21b547c150d3c7a00bb5d0a9b108fb2be1d3bf5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924202, "uuid": "56f95771-5aa9-4219-a355-e61f90eca376", "value": "T15A147C4227FA400CF1F74B48BE7A19759A7BBE5A2D35D05D16A8450E07F3D4488B2BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924202, "uuid": "c87b912a-10b2-449c-89be-b9f14fc545c7", "value": "6144:eiau7n8sQR61VvnLoSgREOkkkbTSLLGrP3/9v5Z8:t78bQVvLoSgR/C2erP3/9v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924202, "uuid": "796f7dc0-385b-4de4-b8b5-f46b550906cd", "value": 197652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924202, "uuid": "5265718e-9cb3-4ac1-9994-654824a3bf06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924202, "uuid": "e944e93b-50aa-4808-8124-9bcfd6e5e329", "value": "WhatsApp Image 2026-04-23 at 10.16.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245a4bc9-3efb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938379, "uuid": "400dbb52-1e1f-4be5-ab56-16fe5b2f71c9", "comment": "Malware payload", "value": "052daa3b7931701875742da9e4b81fe7", "object_relation": "md5", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938379, "uuid": "33d62574-9a4f-4d03-aa25-e77261c2b057", "comment": "Malware payload", "value": "d8c86e1fe39c1e27944205fb72692c9fb0527aa1f24fcb0dfd1cb664eac0ea62", "object_relation": "sha256", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938379, "uuid": "c49032cd-50aa-49bd-b604-6f976ad49d0c", "comment": "Malware payload", "value": "d37eb25f26368126e685d569bdcfb1e321a98f8f", "object_relation": "sha1", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938379, "uuid": "2d01b111-c083-4948-8a7d-d33bc1effe4d", "comment": "Malware payload", "value": "18452784573ee94841db391591200baa050cc47d0a68bd92e0905892b21b191a538f385863cad93c51781daa747e739e", "object_relation": "sha3-384", "Tag": [ { "name": "169-254-169-254", "colour": "#D6EA39", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938379, "uuid": "49d7c0d4-b591-486b-a896-169f0e65ff22", "value": "T10A754C47BCE518A5C0AE93328A66A162BA71BC490F3127DB3F50B37C2F72BD06975744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938379, "uuid": "df61e039-d78f-4ef6-8b93-61bc21167f31", "value": "24576:p1YPMCnyTvZ7qU+/ECn/Y+4BW8XgfvSKY28dU:DKMvZW/AfCYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938379, "uuid": "abe451b4-4642-421c-980e-01916fe67ec6", "value": 1687704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938379, "uuid": "aed6190d-5d35-4899-9b50-f48b1f956df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938379, "uuid": "7223c338-96fa-40e4-a4d4-1a82e99c1b83", "value": "d8c86e1fe39c1e27944205fb72692c9fb0527aa1f24fcb0dfd1cb664eac0ea62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8f8ced-3ef7-11f1-a769-42010a9c0008", "comment": "Malware payload (GoGra)", "timestamp": 1776936866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936866, "uuid": "a896037a-ce2c-4352-a27d-ff2dfd21c280", "comment": "Malware payload (GoGra)", "value": "7bf2191620c2cca5f8238834149ba470", "object_relation": "md5", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936866, "uuid": "686b250f-4c95-4f7f-91fc-479247ea94ca", "comment": "Malware payload (GoGra)", "value": "d8d84eaba9b902045ae4fe044e9761ad0ce9051b85feea3f1cf9c80b59b2b123", "object_relation": "sha256", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936866, "uuid": "252b82c9-648c-4c2f-94fe-706a3023c49a", "comment": "Malware payload (GoGra)", "value": "7f58210fa9fb9a154a8c9b4d595f10c3ef7f79ec", "object_relation": "sha1", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776936866, "uuid": "4f54693c-2e93-4ddb-ba11-1c40cbbb669f", "comment": "Malware payload (GoGra)", "value": "74cf426b200657b52390c8871159c4aa07411f40bc78d94fc3595534fe1745c5a2345a04e6ba1f030ab4c70599304fbf", "object_relation": "sha3-384", "Tag": [ { "name": "GoGra", "colour": "#F7A1B0", "exportable": true, "hide_tag": false }, { "name": "GoGra-Linux-Backdoor", "colour": "#485058", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936866, "uuid": "5a3a01e6-63f8-4ee9-863f-03d084416599", "value": "T182F533F6D898F85DFBC4E19856B9E772FCBBC02C173411D1D898617AC5318F2A622C26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936866, "uuid": "bac33b94-e1d9-4747-b831-8441ed184c31", "value": "98304:GmD/z43ImUuObeMtjzSnkH4d0pXyDslPlwGEm9lv9R+L:GmD/zbD3bb5zcwBiDsrYm9l1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776936866, "uuid": "7e67da48-252b-4cea-9883-2edc61116553", "value": 3345396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776936866, "uuid": "0ef51b12-84c6-4fca-9ff2-816dbd5e10c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776936866, "uuid": "61cdab1f-56eb-4016-82d6-0cf238179bf4", "value": "Details Format.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0049b8ac-3f0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776946049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946049, "uuid": "3e9cd9ba-c98e-4e2e-9b38-fe545d8a3bc6", "comment": "Malware payload", "value": "463b7538432297cce3b7990f3531a38f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946049, "uuid": "39c6e9c2-8713-420e-9d2f-4bd1b03ede9f", "comment": "Malware payload", "value": "d934782f6693177253120b5a8538871e5a8cf66a77096c323874a44801eea886", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946049, "uuid": "46d8f033-11bd-4406-9a4e-efe1c455638e", "comment": "Malware payload", "value": "9a13a46542286602622261d95601aa5671e20913", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946049, "uuid": "4570200e-d58e-4124-b6dc-48cb76faed14", "comment": "Malware payload", "value": "399aece116cbac8a85ee5209c196a8f1403186015f8efac2e53122391a2d989ef3232f854b92bc7438fb4ddb6eb7e8d5", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946049, "uuid": "3b1cfcad-6cd8-4a6a-b79e-d97d5c032f76", "value": "T1DBE38E59146B48AA09F36C3B416605869FD6572A3F00C1E5329FC7946F0CF90ADEEBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946049, "uuid": "885b6191-bd1a-4010-877a-b91a090f0f35", "value": "768:XIfJWjR9fvEsmb6E6NSGMVTFH6l8KYDcCCFCCA+CCsCCGCCcJCCRrCCTqLKYRXwT:8JWkmNSGa13h7ablo2lbKnG2JtFEf3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776946049, "uuid": "be6666b3-01c4-4203-a89c-23db805b01dc", "value": 143820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776946049, "uuid": "90032a98-1df1-4416-9596-8992dec40324", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946049, "uuid": "94e8679b-8575-4571-902d-0b300567f912", "value": "Server_Logs_Raw_1558.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efc657b-3f13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776948785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948785, "uuid": "74541573-b791-4e3f-95a4-cf4d323a03ec", "comment": "Malware payload", "value": "2933802284fd31e331474f006cb70fab", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948785, "uuid": "6c976e5d-b50d-4d89-a376-4a3bab5991e4", "comment": "Malware payload", "value": "d97418be9ee255e58da119e11febca256dffece3023783c940bc400140d2b45f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948785, "uuid": "3b12c7b9-62cc-49aa-8384-a294646e3686", "comment": "Malware payload", "value": "c1b4d8f85c1ff9458fada2462da641bccc0b0458", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948785, "uuid": "25a5ea43-3405-4293-87e4-20646bdfa0db", "comment": "Malware payload", "value": "54a40335142cd06a5cdd6c2da0f98e0bacab7e9706df047fe0293d15068dbfdab65099e50dba97b811e2dba88c13e04e", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948785, "uuid": "54fdb132-0f04-444d-b900-51101db48dea", "value": "T18455234B23E875E4E063E57582100644E72BBE3B135457EF278482AD2E6B3E95D3AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948785, "uuid": "92f1068c-dfee-4ecf-8ad9-bb4f59fe3b57", "value": "9bf63231b3fe5c2739f4e05245901766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948785, "uuid": "06119753-96a1-4fa7-8f3b-695ec27b5f8b", "value": "24576:OpPP3qzgDzppAnQBhlfeIfqPGLQCAaPCVYv2rx16u9jkKBRaLi:o+gHkGiIfBzAa1msu9ni2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776948785, "uuid": "32784a46-d879-4d54-8d32-95d063a8b9d5", "value": 1384960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776948785, "uuid": "474e6611-51fc-44c3-a4c3-5953128bf65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948785, "uuid": "0756d45b-0a1d-4a03-9a0e-ae2dce2874ea", "value": "d97418be9ee255e58da119e11febca256dffece3023783c940bc400140d2b45f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f8de08-3eec-11f1-a769-42010a9c0008", "comment": "Malware payload (Lazarus)", "timestamp": 1776931993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931993, "uuid": "e3515ec4-7509-4bfc-81ca-f894b8a464dd", "comment": "Malware payload (Lazarus)", "value": "5ea8f313a51ded53f6f6754e9adf659d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931993, "uuid": "f82b9118-edeb-4c88-92e5-b193a749343e", "comment": "Malware payload (Lazarus)", "value": "da4c156e240ba254f2a88ecd980cc5c1410814745ac08ddc68abb2d19eff277c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931993, "uuid": "8dc2dc26-5cd3-4fe7-be9a-0460dd9d60af", "comment": "Malware payload (Lazarus)", "value": "2e7bcebe35c8fa8f7a98631159d59492fc285b97", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931993, "uuid": "fb46f4b8-8707-4fc8-bf27-3214b5be1319", "comment": "Malware payload (Lazarus)", "value": "45686a0a14c63be575e297ac31e670f34b5867317ee2cb8826d3d2bc0c4c1618228cbd3c1630a2a06bf15a17c2979b8b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Mach-O Man", "colour": "#F1E741", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931993, "uuid": "b8c8dbb0-2ca6-48a7-b2ff-ac532df9b65d", "value": "T11DA5F1220E2E4A79F1D777FBF6012D03E42F386885195BEA61B0DE1E69D7A51700C2B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931993, "uuid": "24153893-719e-45eb-9456-506b49195893", "value": "49152:7ZRoIsOXVG/6DA99EcTAtJwkSC9x6WBxCFl1:7ZRd04cicY3nev1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931993, "uuid": "78fdd152-d411-444e-bbe8-0864240a0613", "value": 2163360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931993, "uuid": "0975efc3-5e94-424c-ae1e-9046a73f86a2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931993, "uuid": "b7c3f60d-22fb-4e5b-9c3f-a907a5b4350c", "value": "da4c156e240ba254f2a88ecd980cc5c1410814745ac08ddc68abb2d19eff277c(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060ee565-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985573, "uuid": "496c170b-a728-4321-8a6d-75442af1d259", "comment": "Malware payload", "value": "8cae4db76c0f9e697ffb39577c1f4a53", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985573, "uuid": "08734ab5-8b3e-4b8c-a892-99a2e5bfa6c2", "comment": "Malware payload", "value": "dac13d2d6bfa5b0da93a4b37b923b99e883e2ad07b376a6d0812e3d2e0c42945", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985573, "uuid": "6813ef5b-1523-4827-8df8-2b7c25bc0296", "comment": "Malware payload", "value": "7196d0336f7e32adbe60bafa6ce2fe4f12d02060", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985573, "uuid": "93ed1728-c3fa-47b8-9ce0-162d0dfd6fab", "comment": "Malware payload", "value": "2d955c650be6096bb80e906b2dc1019cd565eb9cd19183b106a2251eb45ba782a09baac2e3dbb9c44e27aaeea1cbf7e3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985573, "uuid": "fec973e4-2cf0-40f7-ac0f-a1f62b0218b0", "value": "T12AC312302AC9C9DF1CD74D6121AF499EFB9903CD501AB6993E5CC0CB8A2700F2DF9456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985573, "uuid": "98046009-f7c0-471c-99ca-6b3cc5239bec", "value": "3072:ByBiZ644dykUmuZNWrn2OhP/OH1C1tMvkwavJpMceTJg4MVOs:B/Z54kNNwn/KorFhqcelg4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985573, "uuid": "a3af83a6-02ad-43d3-8119-024d1cdea7d3", "value": 122978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985573, "uuid": "d0b17dd5-a08f-4b62-aaf7-82acd1b82361", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985573, "uuid": "5881efc1-91ab-4ba0-bb2e-bdd3ca2baae9", "value": "LACK.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac2a105-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776964401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964401, "uuid": "240c4fd6-9894-4621-ba47-5170b59dc5f1", "comment": "Malware payload (Mirai)", "value": "cc62ed9278d4f8296371cf21c8dcc01d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964401, "uuid": "c8992d4b-a267-4d0e-b83c-7fc142de1b18", "comment": "Malware payload (Mirai)", "value": "db59e598d82175a140b9e86f9b2e53f05d348d0494d0690abbc44052c2403b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964401, "uuid": "509e81f9-e758-4861-a160-41c914baf1c7", "comment": "Malware payload (Mirai)", "value": "a4d474ecd75a0a031ce17c773fe2871e8ee1ae0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964401, "uuid": "39ada221-82d3-4eb0-8cc6-5e6994491c53", "comment": "Malware payload (Mirai)", "value": "168fbe112ccba784a2c380d019bf1022cfd7104f1f659d9c52eeaac54ee4d0913296ce25946cab09e0c1cf1163feaad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964401, "uuid": "348d2da3-596b-49e6-a148-62aee7eab429", "value": "T19D2471B1E94CCAC7D026727D91AA8F3B8D3E73DB2645CD017DD160368AE5BDB2906C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964401, "uuid": "f203fa4b-c216-4c39-a367-baf92d4c6717", "value": "3072:aEkrarsu0OeMyH4rDIY542JxDnTmIx7DzdkdSdVdX/OWWQ:zv0CyHuDIY546TmIdDzG8fVO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964401, "uuid": "0f122ea2-6c29-407b-bd69-062ba344e57d", "value": 215616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964401, "uuid": "a862d81c-c1f6-4069-88a3-a09f748ab7b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964401, "uuid": "cff613ad-b1bc-4098-bfda-373c600370d6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ec24f0-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1776944691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944691, "uuid": "c31a5b1a-dc43-4021-820c-6900cfbe06c5", "comment": "Malware payload (WallStealer)", "value": "9e9505efad0db16ab24664a82cc3012e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944691, "uuid": "17cea943-ffa7-43aa-a3d2-0f45a4d548a0", "comment": "Malware payload (WallStealer)", "value": "dbe83db6cc44e0f8af12a5731f99e3a1e90129f38c4c9b149b3887dc6dbc8b19", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944691, "uuid": "f4d5542e-fe7d-4ae5-bfb8-4b29e1e404ec", "comment": "Malware payload (WallStealer)", "value": "eccd5ca7edf0f602e42d8ba428311e6a1a02cf70", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944691, "uuid": "11dbac36-0846-4c3a-8531-985afbf9a19f", "comment": "Malware payload (WallStealer)", "value": "1a2ef1926f85bfe49f4f87c9c273233acbd727739e3eaba012bd1f408c3a67f9102e65056fb17076651543a98597d3f9", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944691, "uuid": "2d29c8a7-1bd5-48d8-9826-bde85da5945d", "value": "T1C94633967AC71AE0DF02CBB005672DFD716577AA88AC8C8732C8B6044EF7E14193BD59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944691, "uuid": "84bc8315-8c26-401f-be24-7f78f39dbeae", "value": "8a91602bf23cf2a33b182a065cc80963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944691, "uuid": "80024a8e-9938-4dd1-b0ef-74ee3c7afa42", "value": "98304:YXZF7BBXXFcKQIrWpuERMi0sepias2RfFFOaacwEaCv8fsLQ8YBgocSq3B+oBxgs:I3tBnSorWIqX07s2RfFFOa5x1v8fss8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944691, "uuid": "cc9bedc8-3053-4563-90e3-8b40eec4831b", "value": 5363712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944691, "uuid": "25af6c58-c954-4d73-baad-ce531f4ce329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944691, "uuid": "5ff17e69-4229-4925-8d38-3aa2e18fd3c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3c99a8-3f0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776945370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945370, "uuid": "797e0d3f-1803-4bb9-b117-8f06282c2de2", "comment": "Malware payload", "value": "cbc2f6016666a23b3cd154488973719f", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945370, "uuid": "d731130b-c840-4b10-ad5f-5b8ba2e67cc2", "comment": "Malware payload", "value": "dca72b265088c1129a616d29b99940f91c5ee33848aecf10ade8a9716c76ec28", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945370, "uuid": "75d8f680-e309-4be2-a97b-641a0d011a68", "comment": "Malware payload", "value": "acb38213586f9798173e1c89103936882c4c452a", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945370, "uuid": "db48ee31-619d-494f-8d9b-ee51b3a19d8c", "comment": "Malware payload", "value": "6d0525afa16d2d85f79000c0580268582783be56109e333faa04b7bb67e79b1b73c07c0950002848a1576e4160bd005d", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945370, "uuid": "2d39a854-6aa8-4e95-8e43-5af02bba6bf1", "value": "T1907395D21926C5B222538D098BCD6818F5FEFE21A992BC31503E65A154E7836F23F5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945370, "uuid": "4f7d90b3-3709-47ad-9b16-2b74261d2f5f", "value": "1536:znQGGuWHHP/dyvAQIDP0nhD4TPYtMrRwCTyMevoqqEK9kj3+uNIiSK2kupW/f:zQMWP/BQI8kwiVwR7JjT+uNIiS5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945370, "uuid": "6d5bfa98-6130-4343-b86a-24743c1dbaaf", "value": 74206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945370, "uuid": "0ce71637-8f95-4455-814e-a599155362fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945370, "uuid": "c3057f3e-3379-4c42-a066-bc2652924f1a", "value": "Material Request Form (MRF).CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cb1f10-3ee9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776930860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930860, "uuid": "3d8e7d69-4a8b-4423-9a64-be24023583f8", "comment": "Malware payload", "value": "401dac4b7df30f6f0edded8e2e8838c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930860, "uuid": "56e814e8-d885-40e2-80cc-a18d0cf57022", "comment": "Malware payload", "value": "dcdd0687ffdbb78ffcdfa75da29a8678707b6c2000c59d6035e95fcabbedacce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930860, "uuid": "30a529b9-25bc-407b-aef5-d23a7c0ed32d", "comment": "Malware payload", "value": "f60b4c908a8c1d813cd344d626c4d60bbd29b668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776930860, "uuid": "fca6d307-c8ea-45cf-97e7-1a90198e6a6b", "comment": "Malware payload", "value": "33b1e19d4618cde82aa99d065a92fd2d4343fb81a0006c1b0856904694fa4cf796c6b12d54d060cab38dcc0686cf2bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930860, "uuid": "aeccb9e2-6a22-4055-864a-eb9f7f8fcf6e", "value": "T119C59D05E7C44EE8D54AD934CA1BD73BC3B1B45A0335A6DF1A9AC74A2E737A10B7A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930860, "uuid": "57efbc29-1fe8-4445-beda-161b12b5c481", "value": "2d715890c9b8a11e3db027c092576d3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930860, "uuid": "372372a8-36a5-40ee-8499-fcf31c00dcdf", "value": "49152:SZZDLKyIZavZAQzLoObb6N0FzGWuXoM/:S7DBlFzzuXoM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776930860, "uuid": "2c291479-7989-4621-9922-45e76ba03cdb", "value": 2744832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776930860, "uuid": "bd28589a-2982-43ca-93e9-b8d8b6af874d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776930860, "uuid": "9e45195c-0644-48e3-a198-658900a05655", "value": "msedge_elf_8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31f17e3-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927988, "uuid": "c819a98b-9754-4518-a67e-302c86adddc4", "comment": "Malware payload", "value": "9ce2917a9cdcb1a8e768849172957f77", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927988, "uuid": "a6592135-fe67-4139-9c30-c372e06fad06", "comment": "Malware payload", "value": "dd3ef041b818fea6aa404f7759909e5a1a15adefea2afdb859c644a292471405", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927988, "uuid": "9273e6d0-93f8-4542-9a2f-aa44f24ea019", "comment": "Malware payload", "value": "9dfed9050d0ad5d0d048d603cda757136b0d90d9", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927988, "uuid": "1eace06e-7423-40bf-acb5-6887cdb082ec", "comment": "Malware payload", "value": "99415fd3e14fe2fffa844a38e1ab8ae0e33578ec92e1999406261ad558c8a74d40017f5482c37ad666553f2328b23b4d", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927988, "uuid": "152acf48-2f23-4f2f-bad3-35f258943983", "value": "T1262723032919342F8BBDA2EA543DC74A1BF81F3128D27BD998F1347D548DF292C526AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927988, "uuid": "23685132-8c26-4d7a-bbf6-8ed59c1c9a27", "value": "49152:2kzj5MWC1tIP6tdxGRREh//MPd3rS9zqLZAELfjx+HhklA7VrNGOGzINxINIAjEY:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927988, "uuid": "233efcd3-f743-4e92-8a85-6be233ab11a6", "value": 21851522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927988, "uuid": "3428e4d6-c9d9-424b-80f7-ab43b087f5dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927988, "uuid": "c500331f-fbdb-4468-b5b3-605fea9e345e", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71457020-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934213, "uuid": "00cc9461-79df-421d-a305-41a9931cf17f", "comment": "Malware payload", "value": "4f9e4f58a96250f78806ba5e0bf06b2e", "object_relation": "md5", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934213, "uuid": "c90e01e1-d2ec-4710-980c-9262e00e815a", "comment": "Malware payload", "value": "dd8080fa531d173a1f429a33eb911eac18d6a84daf76dc335c2775ff4a8f2334", "object_relation": "sha256", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934213, "uuid": "96cd9a16-d19c-4cac-8f96-276b7e58e0c0", "comment": "Malware payload", "value": "8d43fad552a7e93103bd59a82d99bb290dfcde82", "object_relation": "sha1", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934213, "uuid": "7661af96-6f78-4a10-88b6-d4ef994dfe3c", "comment": "Malware payload", "value": "13eb2f369484aaabd280ef1a92e9b6c4d2d307d5084a3f9b2d9b1600a5e0ad1e879d2dcd5c70ad44e94930e9078f1a1e", "object_relation": "sha3-384", "Tag": [ { "name": "144-126-148-231", "colour": "#75F798", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934213, "uuid": "d07febc7-98f0-4f25-bcf3-1132ccafd759", "value": "T18511E60057CA29F2F86058312AFD44B8BCCCCF444AD680BF786A883E8C4068D7B5362C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934213, "uuid": "03b2fcdc-24d6-4c3f-9bf5-0c30394c4b19", "value": "24:9wN6smTTV+esE67yQi8UqvyzDtFd/qV8ccNisw:9wZCTV6TyBHqv2BzoLcxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934213, "uuid": "46090278-038f-49e6-b6cc-e43c60e4e9bc", "value": 909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934213, "uuid": "c35afc43-4bb4-4dc6-b2f8-cc2fb0f072fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934213, "uuid": "ed5f73e9-974e-4170-8a9b-208671f0bbe6", "value": "Invoice_Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caca21a1-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "0a002211-8d99-42ef-a9b8-f65eaed0ed75", "comment": "Malware payload (Mirai)", "value": "2c63217c4c7e32467aa3bc8b0dc0d3ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "e31455f4-f61b-4a92-b812-b764b251a753", "comment": "Malware payload (Mirai)", "value": "ddfe0a230c58e1bd0d6e6024fa096a2da30f6ee494634dd77e88566543b2bf56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "95ae2948-d91b-489a-9efc-fadfd9334ad9", "comment": "Malware payload (Mirai)", "value": "e756bf3b1dcf08396ae48fd54fcd02b75c4efed5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924485, "uuid": "b89fdf23-e695-481a-9875-901435d8dee9", "comment": "Malware payload (Mirai)", "value": "0c0bf1ffe2d4daa40a7aa3d5faa7c3751d9d721b32f54264ca58993aff192d3f894b81bd6a40a22aee20410b1580b72f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "59d770ee-1327-4fb6-b6cb-92aa5faf385b", "value": "T14C35190AAF500DFBD82BCD3706B95B1624CD684362953F367538DA04BD5AA0F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "faba79a4-50d2-4684-b195-f3325663139e", "value": "12288:3OfdVW8/AAcAbw6lBTqmlZyeQbq99Mwv4MK04JRIgd7:efdVWlAcAU6vRlZpQ+9Owv4T049", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924485, "uuid": "a4e9cab1-3f5a-41e3-9cb9-11c1d49dac68", "value": 1058620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924485, "uuid": "57c862e8-301a-40c3-9398-1d201e218b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924485, "uuid": "e69e7d06-1343-4bed-8c70-7e4b38e97db2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccc081d-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935064, "uuid": "892aa378-9910-42ac-a958-c01d6f5799b1", "comment": "Malware payload", "value": "6270a752357120c8dcd050ee4ade3700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935064, "uuid": "e4b28e56-53f9-4d44-983c-59c4acb50116", "comment": "Malware payload", "value": "de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935064, "uuid": "76fac0e8-de75-4962-9791-0c23d4ac2ed4", "comment": "Malware payload", "value": "2e795073541fdb6451adb36c117a57d197b87285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935064, "uuid": "26294aa5-3b3a-4860-9525-a2005e92ab31", "comment": "Malware payload", "value": "2d259385a07dcfb8821d04f611c8ce947a0a7553af8e55b22689e1716555b9761c3d71021a1ce7f455792fbb11343e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935064, "uuid": "1c5f9a40-b19d-463f-bb31-1525e0f23ae1", "value": "T107522B4A75E167C6E10F9BBCCC6653C67CD3E6795903CA6E5CB8E05E08A8F58781202B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935064, "uuid": "9a4a08b4-d752-4da5-b2c7-917bfaa389a0", "value": "192:2nF7THbHgkHxHiHLHWHEHhHGHTHrHBHbnHnHj75XlENt:w7T7JRCr2kBmzLhzHDzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935064, "uuid": "3cd0bbcb-5cc8-4081-9819-83864cd1c891", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935064, "uuid": "b8d06061-c9b2-4b11-960f-4f25682e6bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935064, "uuid": "d6fcd6ce-81fa-4a0c-9bef-83ea88fc67a2", "value": "de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b788971c-3ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776918439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776918439, "uuid": "32bc7ac8-bae9-4232-b9cc-a239f72e377b", "comment": "Malware payload", "value": "bb0c121384f2b95015428b9108398183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776918439, "uuid": "48eaddb2-6cc0-4815-861a-64cd63fa74e7", "comment": "Malware payload", "value": "de7fe8842c46bc5c2f723dee3d4b07043d531d067c06caa3263000bcc41aecdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776918439, "uuid": "525308ad-ce69-48a3-9a3b-90c9e43866ff", "comment": "Malware payload", "value": "c9f8beda9d1b83eed4d7a47164763c68599a5f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776918439, "uuid": "1932ebdc-0f5c-4a97-92cb-bdd4703c5fac", "comment": "Malware payload", "value": "f448672806db382471df331644ff51cb5b69ca57d423ff2193487be5d9fbd61f4ad87d7d19cf8d9f2c0489fbdfe1906c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776918439, "uuid": "eb95f8ca-5335-4337-803e-52fd49dab380", "value": "T1CBF5D6E620C6A6DDC416C5BB8713FD7F888F7936862AD8F3A064F2225D25CC43675E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776918439, "uuid": "c63b808c-52a9-4f9c-aa54-a59feff95c03", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776918439, "uuid": "20c472c1-d69c-43f9-8b53-f31756642847", "value": "49152:PfzUi9Dt9HyaUp0VimykkoZPwdP/PaERrFsp:PfT7oYEoWdCER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776918439, "uuid": "399ade53-5d80-4015-8dae-fa35aaac467c", "value": 3606016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776918439, "uuid": "76950c5b-706c-4055-9489-a6f276d6912c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776918439, "uuid": "dcc36271-8524-45c9-b672-7d0358a64069", "value": "sys.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f344bd-3f0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776946079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946079, "uuid": "34f5c02a-b702-4c89-8294-9333d4798f9a", "comment": "Malware payload", "value": "f1ce12145a4960b0be89866bfcd038cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946079, "uuid": "c14e4ba4-cfd7-4a58-a77e-0fe57cbb04f4", "comment": "Malware payload", "value": "dea8542cd3fa0b88c19d435140f0d78c0355717a00c2b4e9a8132cda609cac46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946079, "uuid": "17391fb1-cab4-4f8d-9b1b-6844c39f9afa", "comment": "Malware payload", "value": "c18fba31e9014c7df88344678591d0dcd52df367", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776946079, "uuid": "0154c676-c534-423b-a36d-873d44dd60f7", "comment": "Malware payload", "value": "39b92bc5067f973da43962335cfa6d3d62175338268bd80c6de4e098e78b5cf5fc3f700c8e2d9aebed400429f96e92a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946079, "uuid": "a0fbc263-6d5e-4bca-b9f6-ca0d20698287", "value": "T1AC137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946079, "uuid": "de8afdf5-8223-4b20-8ed5-e2e7e06d6e76", "value": "768:bR+o9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bR+1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776946079, "uuid": "a17e3da3-04c2-401a-9bb4-7136b1b437c8", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776946079, "uuid": "220269af-b766-4fef-880a-c1dcc7e5e144", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776946079, "uuid": "a1ee805e-6112-4da1-b51c-9ef4681e0282", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb25fd3-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928003, "uuid": "a78cfe6a-93a0-4ce1-b665-b73153722172", "comment": "Malware payload", "value": "4838302168ef8646965aee6743c0595f", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928003, "uuid": "fbff14ef-c61d-4599-98bd-43aca0acf1cd", "comment": "Malware payload", "value": "df9b1186a4a093c279ea21e1fef0db6e89b63aba3f861cc42feb5086dc9da2a4", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928003, "uuid": "9efca0a0-04b7-4fb8-945a-71d7b344bfe9", "comment": "Malware payload", "value": "8e8cbd467e31c70e270ddaa569713085fc2b4a5d", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928003, "uuid": "a22d4f11-fa41-4272-91c0-40bb37c6f420", "comment": "Malware payload", "value": "37416b4e36b0ec1a728e45558bc298e38e13df4caf3dd3da74e8c3baf653e64b33216f7fe61785cc885eb60d4f3ea939", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928003, "uuid": "9d746d18-8b36-4a67-a85c-8f335753bde5", "value": "T18E27230E4B9B9C1DA7E66011A48E4B9B009C8847C458FDB6774C27EB6F9FF0E24A7135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928003, "uuid": "1a893a3e-d1e9-4af4-ac56-041d6a291b20", "value": "49152:SsynFsyn7synrsyn6synqsynEsyn6syn1synxsynUsynvsyn9AEsyntsyn+synk6:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928003, "uuid": "dd36bc02-f1b9-45d0-b259-8468895c5b1d", "value": 21131492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928003, "uuid": "0d1f2e39-6978-4ec3-9c83-7f3fb6a54123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928003, "uuid": "9cdfd76f-5a60-49f7-b301-5f5a8c19f5d0", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b351458-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935035, "uuid": "3d040609-cd80-48ff-ad09-003c2e029146", "comment": "Malware payload", "value": "5c44ec1a445cc07c3e9342e0364378ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935035, "uuid": "b1cfc2d4-1a67-40a5-b915-8351aaf06f93", "comment": "Malware payload", "value": "dfd21a363f4994794f821d76ca61c834882a51b5c6f7b95627b70789462149e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935035, "uuid": "225a1556-2a20-4e7d-aef4-e751723ce0f0", "comment": "Malware payload", "value": "e50aa51262843ade2dbd1752050aaf46b8ee3165", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935035, "uuid": "3709d84b-aa15-47b8-99c0-8460cc9703a0", "comment": "Malware payload", "value": "d8bd9779338ba3bf725a43ce0b29b1d0b4406a79a5245a40ac9edad06f9a68dca17bd82379a9ecdbfeb701c0dad2b934", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935035, "uuid": "5687a779-6174-4ae3-9ccd-132449d79597", "value": "T106C19222D7D90536E8BF4B3CADE2074253B4A44807B20B6B1DD852177C975942973BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935035, "uuid": "02ec26a0-9aff-4813-b407-4e53c2fcc90f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935035, "uuid": "5a6e47ae-c380-454e-9a3e-6201d64bfb78", "value": "48:6KRpcrzSjsj84XdCXVZPmXBkrZRJrLHNrsoQmkugzNCCYShXwiyaaZlqglSto4T0:qmjsj84iHm+FAmk5Xwj7S391GJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935035, "uuid": "eab4dd02-12d5-457f-b432-3085588a90f8", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935035, "uuid": "78c1ad6d-45a0-4125-9408-8c2f67228941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935035, "uuid": "fcba902a-89e3-4ebb-bf88-87b7f9c18dcd", "value": "dfd21a363f4994794f821d76ca61c834882a51b5c6f7b95627b70789462149e3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2267ccf1-3f6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776986479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986479, "uuid": "cfb5918a-96be-4b82-ba71-63fb886f9e23", "comment": "Malware payload", "value": "88afa5419e3c92069cfafede0be555da", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986479, "uuid": "6ec77119-2d04-4b05-9a88-e7dcec19bcd5", "comment": "Malware payload", "value": "e0ba5641d4ebc6292c44b817c7cc0f74aa8fcf416006bbe27b194d2cc773bef5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986479, "uuid": "771f5181-b54d-4e2c-bf36-32ed5f5d0bf0", "comment": "Malware payload", "value": "41e8c1b38c48f67cb4dfa633e9c8b75eac458eca", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776986479, "uuid": "90c64d08-0a4f-4aad-b7ca-91c8897a5330", "comment": "Malware payload", "value": "281bf7e7fbe22c89403f6337f864c2bf2611af75f8fe267152471b0aca7df4c877e69d5bd807484b670dda0d1fa00e78", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986479, "uuid": "b10135f4-0189-4ac5-a131-5985b5ecf5e3", "value": "T117713A213C7A9D1B8532F4A0C88B5D83EBF952C33C936BC1AAD720696467643463DADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986479, "uuid": "f19e018d-06f1-4f2a-9310-b1fea41b6f8a", "value": "96:MDU82h8hRhdHhhhHhShXhFhvphILhomhf3NYNdh3MMGWu7xqxqxdA:MDp2OHTrBEJflpchlev9zAc8bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776986479, "uuid": "015bfc9e-e2e1-412b-8b86-c00e2bdea930", "value": 3476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776986479, "uuid": "810588ca-4c09-4208-a570-05e588eeec88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776986479, "uuid": "ea0346f2-368c-4658-be24-a13db77df4fb", "value": "D4B.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4924d7da-3ec0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776913100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913100, "uuid": "05b19f76-d396-456a-b20b-f08179dfe5f4", "comment": "Malware payload (VIPKeylogger)", "value": "f65cf754c315bc223fda4dee8ebc9a02", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913100, "uuid": "81b6f57c-a852-48d5-ad4d-07f53b045f4b", "comment": "Malware payload (VIPKeylogger)", "value": "e178ec2c637f8340288d0928c5de1a852e5f6fdded6327cfb3fc2c752f0c88cd", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913100, "uuid": "f9fbec7e-3683-454c-a050-db37fca38d2a", "comment": "Malware payload (VIPKeylogger)", "value": "e315db400b398c97ebdd9c76c9437908b6214722", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776913100, "uuid": "08a0920d-d507-4126-9e2e-da1003cd2a0a", "comment": "Malware payload (VIPKeylogger)", "value": "5513c4cca5588ba8c21c4fc4e810d26634b97feb5359fad1bf903b9387f2859115bed8c733a42470761e86d10a00b2fa", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913100, "uuid": "d31ab0f1-4a39-40df-b919-87a7ee9a3372", "value": "T1D304234BB520EDE91C0652B0B4DC753C85930E5397EB3039EEB0ACAB34F590851CABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913100, "uuid": "56c3b77e-6766-4a78-a0f7-a8b0516a6633", "value": "3072:aYu8D74d7fa73Dk6ssOzEW9I31Hstyk9pr5AnDK1ycPiQxYZ8ICO3anKSJ:aYZ4ZfXsq/9aHstvmDKmeiCO3a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776913100, "uuid": "c10377a1-9395-4574-96cd-2a66754c2df0", "value": 180528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776913100, "uuid": "c9333cbd-0c72-47b4-8729-f8187e7d4598", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776913100, "uuid": "f1342a6d-82a2-4a19-99b5-17140265962b", "value": "ENJOY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701ec070-3f14-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776949243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949243, "uuid": "a3d35904-bc17-4dc1-9b61-18ba9a1cbe77", "comment": "Malware payload (DonutLoader)", "value": "5d23b3669b1310a185835e042e4fcc3d", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949243, "uuid": "b0784ccb-7ff2-4542-b582-5186097960ec", "comment": "Malware payload (DonutLoader)", "value": "e2160b52a9bb90ed24093fe1eec66c13706331a2d1144ec40dc6af9a65ad31c7", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949243, "uuid": "66dcefe5-9e5e-47d7-9fdc-c8b9bfba8640", "comment": "Malware payload (DonutLoader)", "value": "5b1782bf492831a815e0d6480191d38c9219f0d9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776949243, "uuid": "be625388-6392-4489-b147-c3bbe6f22d2c", "comment": "Malware payload (DonutLoader)", "value": "99066c439914666852ca517a0f14570bad97fb6df50fe391e26f24efe73117015738f42dfe7bf2ed635236f5d70ef3bf", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949243, "uuid": "e3d365ab-5cc6-4345-8386-52bd05890e4b", "value": "T1E1B4235E7D008A7ACB5D3C306EF7569D25CBB5EC4352F831ADE8B81F7AC32AA0940548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949243, "uuid": "f42b1a21-4d86-44cc-8ed6-3ecaf0154e6a", "value": "12288:yAM1Up8ew6lrSkuFXdYZlzodquc/SRmBgmOYEaYiqMxy+W13K5AL:PAew6RSkuFXf6/YmBgVYZXqMxW3K5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776949243, "uuid": "a66bf045-a1b2-4057-ba60-251ce4512b4d", "value": 540881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776949243, "uuid": "3b63543e-c2b1-40e8-8166-d5abc032e5e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776949243, "uuid": "9daa0be7-a0df-41dc-8e8f-8bb14dbe372d", "value": "nFedex_Shipping_Document.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897d1f74-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "05d2a31b-f3be-48ae-9731-e0831efd6661", "comment": "Malware payload (Mirai)", "value": "e731963d4484bf1894b81f006a301859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "e60cb19e-f429-446c-8e84-9db265cfe6fd", "comment": "Malware payload (Mirai)", "value": "e29b3d9441caedba74df3c70096d6d97b53c600fc4cdd6b50021bb07804f770d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "61857ca7-ac30-4af6-b30d-f8e9597cf5d0", "comment": "Malware payload (Mirai)", "value": "3afa51935ae981e90654a6e70919226a318b3047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "63a1ca29-6bed-42f0-b1ac-a6f830865b19", "comment": "Malware payload (Mirai)", "value": "7d788e871eea9dbe263b5858f238a81b66535b30d6b330de0c667b9f1d99c68bcbfb78d44068da5074fa5be4580d8403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "e549ea84-55ae-4b12-932e-62c0fbb20c3c", "value": "T1E3058D5BFD1E3D47D2EAD33E9F4A83B1A22BB190C71351623582032C94C66DD8FB1699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "62034876-1332-476e-ba3d-c5c168031200", "value": "12288:Tl2cuKhpaHvi2yW63wjMRCTCuCjCvJkKlTow5mf4TNkrBY7hTAfmp:gVwpav6aMRCGuYxwWOyrBY9TAfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923087, "uuid": "09fd5ae6-00d3-43db-9b09-ac1f557731fc", "value": 859800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923087, "uuid": "0a4b578a-f55c-46a8-a512-0f1235bc3f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "da6e07ae-9ec3-489b-9538-4d46b1885d47", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2648df4-3f37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776964414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964414, "uuid": "9d189210-88cc-470a-82ef-82d639c42b52", "comment": "Malware payload", "value": "594b771882f526b19ba820f821c277cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964414, "uuid": "813f0384-cba5-4d5e-80c5-00d09711551f", "comment": "Malware payload", "value": "e340cf3faaeb5eb7302108ff8344efe3b7341727586b073d842bfff7eeed01f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964414, "uuid": "fb040cbd-b250-409d-89ce-9e5373c382ed", "comment": "Malware payload", "value": "b4d15126a0e048f25a8b3401432858f2e695239e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776964414, "uuid": "361a4517-6b4a-4fab-b52d-5e552375af8f", "comment": "Malware payload", "value": "8e21d28ffc5fc817f4727bb3ee4e39ae1e9f1d8f2bd703c4a0fbd4cd05f84cb19c89b933bec69ddb1dbd3dadd028d906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964414, "uuid": "c646b4f4-43af-491d-a8da-908ae0d13b95", "value": "T1BD430131D3E5EB69FAB649DECD900B887BDE4A9A7BD1F1F36E114615B0D01523128CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964414, "uuid": "a4978c56-1789-4417-a673-c5a02381cb3e", "value": "1536:GCdZKkukrhl8cY69aUdCGu4I/37me2g4q/54u+qgw06WX8:ndZKkukanFjL2gP4u+qgwXWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776964414, "uuid": "07e38ee9-ffaa-4ac4-a74f-622b5c8e11af", "value": 58972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776964414, "uuid": "96055a8d-9d82-442b-90ca-eb19585e8475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776964414, "uuid": "cba29238-760d-4d82-a12c-c6e298d17919", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298768d8-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968452, "uuid": "4fbdeafe-f69e-4755-be43-242f3a36fb9b", "comment": "Malware payload", "value": "bdff63f86cac0748cde4a692a57756c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968452, "uuid": "c27d8a6d-9783-4d82-881e-c03908111de9", "comment": "Malware payload", "value": "e494ce6af136876cba1adfe3f9d6e151f1dcf9a38059897cfb509e30e12b8c7b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968452, "uuid": "0b4caa78-d8e5-4723-ab0f-b0e1b264195a", "comment": "Malware payload", "value": "6298fbcc2adc97bf774596abad220ad19c6c8f29", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968452, "uuid": "a8273852-34a1-4c59-94c2-d18719fc6ad4", "comment": "Malware payload", "value": "42582948b4ee5a6b9353f90da7bdd42f4633cf1fb51bed77ae7158a7084597602d6be3b00cae82d804b8a0aab1f9b5eb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968452, "uuid": "abcf95e6-3a1d-46f6-96d8-885bfa71d9bc", "value": "T10B460185FF59952FC8B700734F66967533968C02CE929B17B598332C2873AE80F59BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968452, "uuid": "bd96c16d-8f5c-4204-a6d5-db091b9b6704", "value": "98304:iVg2eryKT0nwaIx9BPoNBrSFqj4IXDp7vx2r5SsiWgSsiW+SsiW2FSsiWGSsiWkk:iCFT03wM4IzFJhsPBsPPsP2IsPnsPiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968452, "uuid": "4d657022-fad5-467c-8f82-1e6d4ae98a7d", "value": 5381056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968452, "uuid": "205fb5bc-c96e-4308-89bb-8fc2d8076cb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968452, "uuid": "7a3588b1-9b71-4a0e-b4b1-75e6c9fd259a", "value": "e494ce6af136876cba1adfe3f9d6e151f1dcf9a38059897cfb509e30e12b8c7b.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bfe1c8-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982186, "uuid": "8fe547e9-3b2c-4d9b-926f-ff024f309b14", "comment": "Malware payload (Mirai)", "value": "6d7fc7ef876da9fc77887867db581238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982186, "uuid": "aacfccaf-207c-4295-84ba-e46f5458e31c", "comment": "Malware payload (Mirai)", "value": "e4d7e55adefa71ddbf1fac99e2dbe78bd6d8212b1d26d30a8de5de4b4ea9d90a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982186, "uuid": "9d21d1d8-b868-4afa-b3e5-57f3a8e009b7", "comment": "Malware payload (Mirai)", "value": "d8e599710ad19fcd884f38d9c8e5e61cf0a4b032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982186, "uuid": "46e667fd-005e-42db-b55f-31375d99743f", "comment": "Malware payload (Mirai)", "value": "92a9eb604fdeb56145268e634aea9fe8ed2b0ec168a31382878ac52e8b21fc863ca01395ee13314ea9d3192272e2693e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982186, "uuid": "365888ba-0f53-49e8-95b4-9704b5d8d5da", "value": "T1D5F3C81AAB510FBBDCAFDD3702E90B0238CCA55722A43F763674D528F54A50B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982186, "uuid": "fde0e351-0bf6-4cf1-a144-54ebeb89bf8c", "value": "3072:MhdpFxtbYbyXO2o8TIUU9ypqnNJg049Loz:MhdpFxtb0ye2hIUQygnf3KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982186, "uuid": "b19d4565-6a5f-45fb-9815-a1fb8464fe2c", "value": 169648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982186, "uuid": "4d02c8cc-fe32-4eca-9991-ffbc0411f240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982186, "uuid": "1bd516fc-29e2-4e8a-a1e7-a05c1ffb317e", "value": "concakhbtandhuy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ff059e-3f07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776943861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943861, "uuid": "15f74226-751f-449d-9258-ff99ad0c570d", "comment": "Malware payload", "value": "efa9f39e86116e39ab969466da6ca307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943861, "uuid": "0dcbdf56-cf9b-4702-b584-ac3b41e0dddf", "comment": "Malware payload", "value": "e514c7b834e8d36b101fae84ab113f00ca1abd1940e53eae476868d83e1ffaa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943861, "uuid": "2e438ac5-1df5-4f01-a234-d62b7c3162c1", "comment": "Malware payload", "value": "387a15eae20406bb79b7c2f5bbee1dda88d28472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776943861, "uuid": "8ba7ef58-b582-421d-be80-04c69ef2d3d2", "comment": "Malware payload", "value": "d03f5efe33f6ff5ce83bcc2e60e6ef8a55f07fba08e15b620ab666935f0cc8ec342bfbf5b198378b65192e67f11bdda2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943861, "uuid": "d015e5fa-9ffe-47e3-a29d-2c3ca9e3f327", "value": "T14D74813EEB2188F9C1DB41B4BBCBEDF15526ED5E0224A14D06CAEA01398FD604BDE5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943861, "uuid": "f11dcd7d-afaa-424e-b983-376331251b8e", "value": "e596e4364c7848e8ff6379e500079094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943861, "uuid": "02530900-54b1-400d-8ca3-b8fe6aed08d8", "value": "6144:591U9sk5QVUuW9LLastdCdcVdqfvsmmYTC4J1vEsvGZh2+0kc:591U9SUuW9LLastdCdcVdqfvsmLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776943861, "uuid": "2642d421-81e6-4f1c-9bf9-5ed502a210ba", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776943861, "uuid": "9718cb43-4b33-4c2f-82e6-95e9150134e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776943861, "uuid": "3461ffa1-3f67-42d7-8dd8-43af547a7de7", "value": "jPrevi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8c14ff-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944375, "uuid": "5f951262-bd7e-4252-87fb-9c4f00d32d78", "comment": "Malware payload", "value": "8716989448bc88ba125aead800021db0", "object_relation": "md5", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944375, "uuid": "57359893-bb14-4767-87fb-409984cf1a9e", "comment": "Malware payload", "value": "e555083bdb62cf9df6aa7101908d9dbb89f55788ddab2e3288d57e48d43abd35", "object_relation": "sha256", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944375, "uuid": "a7715f63-75ac-4a7d-a71d-a82a23da6990", "comment": "Malware payload", "value": "e23b555e8c7264744970829cf98a2e702f3d762b", "object_relation": "sha1", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944375, "uuid": "a815e113-b580-44c5-9c09-fecea1306219", "comment": "Malware payload", "value": "4ea28314d819b8156d489c2f2db185d40ab5898bf2d25c37cdeda083fb1a53fbec688f3adec441de3b1755d70cbd52a1", "object_relation": "sha3-384", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944375, "uuid": "b4752d43-d9e3-41d3-b15f-b5a17fb3b43f", "value": "T1CE86338061D0E5A367536CF0D72DF720719F9A1ADBA21900F4969A85B4278F807BB7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944375, "uuid": "5d2c5fc0-c84b-4b54-8ef2-41ddebec0bd4", "value": "196608:ngDx8MLn/dAFIpjxWcnrxjReyMHVILBgsDm/eReTOh:nSx8MDlzT3beyM1igNkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944375, "uuid": "c98e1d99-cf36-4eff-a807-54c27944f5d4", "value": 7920171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944375, "uuid": "c794ff2a-3015-4678-a2b0-b348fa6bd7e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944375, "uuid": "1a9e1dd3-e8a6-418b-97a4-d34aa2730191", "value": "e555083bdb62cf9df6aa7101908d9dbb89f55788ddab2e3288d57e48d43abd35.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4699210e-3f13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776948744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948744, "uuid": "7cb4f9da-9633-47f7-a7c7-93abfb782325", "comment": "Malware payload", "value": "abf05102364ae51aa33494c1db2091d3", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948744, "uuid": "684623c4-6014-4531-a625-076eb3dbeaf5", "comment": "Malware payload", "value": "e5ef37868df28f2b2f56e377d0b53d95014fe08be4ec1df97714277c3f59c268", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948744, "uuid": "da130e4e-4568-45c9-a56d-6b095a34d4a5", "comment": "Malware payload", "value": "658efee4cef705f8c4ed4267f404199afd1eae1e", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776948744, "uuid": "d38890c7-6d47-43fa-8633-d2dcde18374f", "comment": "Malware payload", "value": "0e9d5b8cb1d185b7db0fe1734234dff6c731c022b511a4a3a91cb63fcbce2b5337f79877b1c28751cc5fa3a65bf7fa40", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8033169137", "colour": "#DDD801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948744, "uuid": "218ad281-9094-4a8c-b7a4-4c82d75cfda9", "value": "T1F7459E16A3A442F9D0AFD275CD468A4BEBB278061770A78F03E04FD62F277615E2E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948744, "uuid": "e46831ab-29e5-466e-80e8-b7a40c8196b3", "value": "e9e99ab7fef6a7fce27b8f28b3853d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948744, "uuid": "84bfc335-94d1-4504-bf72-289724a378d4", "value": "24576:A0VQFmhK6x6511JfKoz31MdiItDvwRbq:AYxE1Koz2diLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776948744, "uuid": "6b31c1a2-cc43-42f0-b8eb-d085b2edd5c7", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776948744, "uuid": "17eda140-e671-429c-a6ff-49d578b40256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776948744, "uuid": "8ae38861-83f5-42ec-888e-4c8e39cd5cf0", "value": "e5ef37868df28f2b2f56e377d0b53d95014fe08be4ec1df97714277c3f59c268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ea823-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776928789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928789, "uuid": "f31c5084-33a9-4a2c-bbee-02822c62e079", "comment": "Malware payload (Mirai)", "value": "365ae9bdb43a1b38063c96cf58845c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928789, "uuid": "c0cc558d-64f0-4c31-873b-0697b3d1e34a", "comment": "Malware payload (Mirai)", "value": "e64c7720f3a2b85813a850540b193e38d37122588f8bc30cf47bd5583f5e3de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928789, "uuid": "b5a2dc46-7088-4950-b1c7-e6e21d723271", "comment": "Malware payload (Mirai)", "value": "80b407ba8eaa2459cd683940998a7ab6ee681fec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928789, "uuid": "289cc31a-a4a0-4422-8ec8-b3925138c93f", "comment": "Malware payload (Mirai)", "value": "f7a8a7d0bd67a11b0da50bf070198f0ccf10037b4c910810cc6293a4367c348ab23a16cf8511981c0b0ef553c18460a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928789, "uuid": "429d870b-f885-4841-83a6-f7052d21ef93", "value": "T117332889F747DAF0CC4305B0115FFB37A936B8A12224DD77DBE0BAA37CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928789, "uuid": "acc53b95-e984-4c1d-8295-de902f87e2f2", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpOR9s0Jel/iE+nKPaO+hTvlwas:oSfvufWuq96f58X3jJelSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928789, "uuid": "a7b902f3-1535-458c-9657-49fbdbb8f485", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928789, "uuid": "9053234a-a891-4e77-8c04-8b501ba9d717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928789, "uuid": "194a4ba5-e34f-4fa1-bcfb-111220525584", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569b9330-3f0b-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1776945335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945335, "uuid": "b32c760f-c799-44d3-a2d4-b782e69b29d1", "comment": "Malware payload (XenoRAT)", "value": "ded2255a0ddbce91eb30db4e6e4d5894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945335, "uuid": "73d8b0d6-4726-4c69-b85b-b19ef5bb9942", "comment": "Malware payload (XenoRAT)", "value": "e6ff193f9686d5dd8cd1a7fe572e81165a97ed0d3898a5207117cdb382613821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945335, "uuid": "ec3a8486-57b2-47c1-87bd-eaec9fb28853", "comment": "Malware payload (XenoRAT)", "value": "b9a142759f37acbc4cea0d23fcfcef83e14b7d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945335, "uuid": "7ef43809-262b-41f3-ad92-72bb8964bfb4", "comment": "Malware payload (XenoRAT)", "value": "8b3d069188d2660357c318fdaa2a80ac7cdfec66653515bd8cccbb8a32bb1939f9513240bd4e3efdb90ddab7105e9610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945335, "uuid": "b944ed20-f987-4b2a-abb6-d56455668210", "value": "T18E33F84C5BAC8927E6AF5ABD94324263C7B3E3669532E38F08CCD4E9379338545053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945335, "uuid": "c6651f8a-2909-4ff0-81e2-9b35e044bb01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945335, "uuid": "5cf00589-3106-40e5-8d05-5b5c171fe93a", "value": "768:WdhO/poiiUcjlJInW4yH9Xqk5nWEZ5SbTDaaWI7CPW5t:Aw+jjgnjyH9XqcnW85SbT7WIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945335, "uuid": "fbd89edf-84d4-4096-942c-6cb8e69ebb17", "value": 53032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945335, "uuid": "d7550ddc-3e9d-4b54-818d-faa8ef610f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945335, "uuid": "0cd8f711-bbe2-4a0e-b77f-9f01c1343aea", "value": "DED2255A0DDBCE91EB30DB4E6E4D5894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1d0d65-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776929483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929483, "uuid": "d6e741ff-43d3-420f-b86b-4bb90d6983eb", "comment": "Malware payload", "value": "78fc20b6bd1a547bdfdcd55709ccd930", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929483, "uuid": "8579bb15-4896-4ea7-b6eb-a562933255b9", "comment": "Malware payload", "value": "e7927e965cdf13f433a7b1273c208c57fbaaa678957d45dd89ea4a657f533512", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929483, "uuid": "4e15acfe-9ea6-4484-87dd-e7cb7267b3a7", "comment": "Malware payload", "value": "0210782d5a3fe6bae4f01b6f23b5a3722a62e81b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929483, "uuid": "14567730-747d-4732-8549-1f55dced3c1f", "comment": "Malware payload", "value": "5c151ab984b5a7c2a91847132d802bbd5c7ce023c74de557496ad12b3b7759459182d17797d46df1b958a97c04eeb648", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929483, "uuid": "b2eab3cd-772d-44d4-a838-417fb3b9d628", "value": "T122C44B02A5FA462638D628BC0BDF9132B557F7580EA56B70742119EF07DEB073DE6B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929483, "uuid": "e1f6eb06-5572-4484-8577-c8d57bc4d54e", "value": "6144:9iiii9iiiiWiiiiWiiiiWiiii3iiiioiiiiUiiiitiiiiViiii+iiiiBiiiiWiiN:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929483, "uuid": "22e5c6ad-abbc-475d-be90-87a2ac49d651", "value": 568724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929483, "uuid": "0b37f311-5ac8-4797-8fba-af25ce03077d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929483, "uuid": "9287d71f-a763-4e16-aa89-932acbaea3d2", "value": "Bank_Payment_Confirmation_slip.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5a412a-3ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776928841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928841, "uuid": "da16d754-f432-49d3-89fc-78e9002b1a82", "comment": "Malware payload (MassLogger)", "value": "91b2420da18f82c5792497425425c03e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928841, "uuid": "1b602481-f95a-46e5-808c-ef301d1cf9a8", "comment": "Malware payload (MassLogger)", "value": "e7fcb6ab49296e69d1aa94091bb639a8ab3f69823ada857ab7fd5b3457a41867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928841, "uuid": "9a2f9e7b-b2a3-4a73-a23d-6a8b60c77426", "comment": "Malware payload (MassLogger)", "value": "7efdf5750fcad900c80e1dc58698f1c55c5766c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928841, "uuid": "07fd1826-19be-475e-8b80-14a34878b7ba", "comment": "Malware payload (MassLogger)", "value": "d3a7f32e11355ed37d13d28c9721e7e935bae90b7aac0cd6e7dec9201abe2b680ae3bb04b806fe42d5bdfb028671ec0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928841, "uuid": "0b6e87b6-9136-4319-8b57-42388df889a6", "value": "T105144A2833EC4A14E2BFCFB995B090140672F4ABEC16E79D5D9620EC2D727469861F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928841, "uuid": "b6d25131-e737-4d81-b320-de175117873f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928841, "uuid": "f2adfb97-f492-4ff6-b037-6c1c33026f77", "value": "3072:3BCBaxeImUupz/qWyPQjs0503fvaJBCIzG0:3UpUjWyPT37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928841, "uuid": "66c63c53-80c1-44e5-a047-fcfa5d725392", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928841, "uuid": "133d09db-4030-4484-b9aa-2d69ad4a59ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928841, "uuid": "3e3dc677-fee9-4fcf-b4f8-35e058c1a4d7", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.75.13765.10084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879230b8-3ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776922654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922654, "uuid": "643ff203-baca-439c-a045-dc35f1a9afed", "comment": "Malware payload", "value": "d8ac873db92dff24caa6641c1389adb8", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922654, "uuid": "b73461e2-be07-4efc-bb17-72b6cfef9c95", "comment": "Malware payload", "value": "e8377d4a4a0cff68fb0f26f304aedf471bc26d29ac26403f94fdcec954c89b73", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922654, "uuid": "104306f4-21c3-40a7-9d8d-f260ea122244", "comment": "Malware payload", "value": "27c95ef70301fa3cdf392dbb33c2dbdeb631ebe7", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776922654, "uuid": "09ed217b-3f3a-4964-8eaa-ff6c75fc035b", "comment": "Malware payload", "value": "449927febb59bee3ee434d5dcc871a28c283a25a9993e1daa848c4937db171886266fb1a33e7cd00b1fbddc9d31225b0", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922654, "uuid": "126cbae5-ee80-4e35-8403-00513d07c998", "value": "T1FE3723555D3ADD5C8BF020AD3CAF3E6E2A24981DDA0D19CF9FDA65886CCBF150013E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922654, "uuid": "3a7605f4-5ea0-4b6b-ad07-27382696121d", "value": "49152:sTufZFGqM6TufZFGqMATufZFGqMtTufZFGqMYTufZFGqMSTufZFGqMITufZFGqMS:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776922654, "uuid": "38742e04-71c2-45b8-a079-7fa38c9ffc44", "value": 23051588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776922654, "uuid": "658d9866-4f4e-4b5d-b3c7-efc9597d7307", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776922654, "uuid": "032c9b70-c734-4c2e-a232-9eae6485cb88", "value": "invoice-1645080830.pdf (101).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff85d1f-3f0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776945646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945646, "uuid": "e8c79070-dac9-4bc5-862e-98b628d903a8", "comment": "Malware payload", "value": "2458dc19c500f63fbd0f4632620e8744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945646, "uuid": "6d131788-f908-4605-8826-5cc73051b3be", "comment": "Malware payload", "value": "e85616b2d9c717eb99269c441a1c51822d4e817ecb421426e33f63357760ec2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945646, "uuid": "554c9ad2-72d8-4cf0-82cc-82639de424b1", "comment": "Malware payload", "value": "f47830e160b8dc23716a92d5e62711ea21f71bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945646, "uuid": "e893b0e2-3b20-4099-a49a-fc2c5f43b2e1", "comment": "Malware payload", "value": "42849f95528035b45cc230c64826ffc70a08d15f128a1108a098490a7961e39cf0597d54a9cbbe86fc088bb4b415eeee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945646, "uuid": "43b2be12-98e9-480f-99ec-34d430af22fe", "value": "T1B884849462EC59A3E2FE8EFCD87C1883476538332629D7892DB13ACD5934701E56CB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945646, "uuid": "b5eb8ff4-0ac5-4fa7-991c-b4fd8593a83e", "value": "6144:0lbeNqz2Rwbfo7Mq04hSmtATUHqlx6IuSvRdfsJTomrPo6ZZg9z/F:y6qz2RwsKUHqlx6I/LdgPoC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945646, "uuid": "b0a79077-63e6-4e2c-b1f4-293765d4d732", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945646, "uuid": "1ad980ad-e5c3-4362-b0cc-f754ffd98c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945646, "uuid": "65c56c91-9966-489b-9177-3f6778a92925", "value": "e85616b2d9c717eb99269c441a1c51822d4e817ecb421426e33f63357760ec2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c99509a-3f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985637, "uuid": "b29293fa-b401-4711-8280-e4dcc00a6a9e", "comment": "Malware payload", "value": "42a98b700cdeb1c92671c4f4d4d5f059", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985637, "uuid": "735eb1f5-36f9-4e21-b21e-d91c5863d249", "comment": "Malware payload", "value": "e885dc71556edc631373746233e5b0b1d8b73f5e1ce4723d06b1eb457e7b5948", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985637, "uuid": "c96c69ed-d521-498e-bb62-e8e9f114a500", "comment": "Malware payload", "value": "3fc4d1033d27bebb87e5e1b117013a66147a87a5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985637, "uuid": "cae901f6-7e65-4211-b4e0-649ab8660704", "comment": "Malware payload", "value": "6dbb7a3bbea78ec5fc440a7acd0977f105ad55d71aa03edf52cb237d941db764fa0e11de4fe913477cf6f4b6c4be2d6e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985637, "uuid": "deea7863-2d12-42c5-9681-8069dd95f72a", "value": "T1ED041240271EDBE1080A06B0A35F4AB9D7F2078FD9CE5F8EB1905E7285849A1A55FF1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985637, "uuid": "f67d33fd-cb3d-4c22-aa1a-0a8409e3e69d", "value": "3072:NBKTh1dikw7iSRvXpl51FtjudhZLkkPK5/7sN3+lU85fn4LASOdKpcp:NBKTNU7iSxrMFryt7s4U82Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985637, "uuid": "a8fb9bcf-b9c5-40ec-841a-f996d3f278f7", "value": 174419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985637, "uuid": "96972699-34a2-4db8-9229-7f849f851f2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985637, "uuid": "a8b0dc78-1359-4630-9cf0-5180fd684194", "value": "Slow.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99084e23-3ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776927837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927837, "uuid": "9a4cb4a5-0923-4d2c-ac54-3792d0da75c2", "comment": "Malware payload", "value": "ff6283199f819d6778f201f1f64971e9", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927837, "uuid": "8c95dafe-681f-4d87-8050-f68f038180a7", "comment": "Malware payload", "value": "e8adf66722bc1176506d1e7399665203355ff3d860a5619550fd6184780d26da", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927837, "uuid": "1852ab0f-fc7e-4f2f-9afd-1afb3f1519a6", "comment": "Malware payload", "value": "b12bac6c35b94c510aaafa6399989c717b3490be", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776927837, "uuid": "5f0e2216-723c-4212-b4e1-46a3a5bba613", "comment": "Malware payload", "value": "7b6d173779d956c946b8a3b2b3854199eab5579c10ad6dad337a3e75a2e29325ea4650aab180ddff93a9e23cb84dfadd", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927837, "uuid": "6967be43-b220-4a77-8cc1-6a0d6b307595", "value": "T17F2723234A33AB58253C64663D7E068E17AD4880619AACFCEF433DC51B4F33A746D66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927837, "uuid": "2557b1e7-3baf-456e-bdea-0e21d58d53e0", "value": "49152:6E+MopjqFCoTF5fPkThIh5fwAu6BsDDrAaqgBT5fB5fw0NI5fTkYkiZOz9vRYh+G:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776927837, "uuid": "74bbcdb7-0a69-4156-b5a3-a42ac1aafa0c", "value": 21611504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776927837, "uuid": "de33acf1-8594-41f6-a9b4-798fbb13c439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776927837, "uuid": "03920db9-e77f-45ab-8624-dcfd146ffd51", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb819f-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928160, "uuid": "bd3b7fd3-2484-43d3-bd7e-10a67b1d17d2", "comment": "Malware payload", "value": "ff312be49f37096f13812250e7da4b8b", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928160, "uuid": "2c93bf74-81cd-404d-8947-b51f3f5178ed", "comment": "Malware payload", "value": "e8cd8f3d6cd7dab30855b27a46c7b9f8e6ebca3e67ff963ea49bac15413623f5", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928160, "uuid": "0bb5beb5-ddd0-463b-a504-0717a422c6ae", "comment": "Malware payload", "value": "c0aa8a80e4e5334bfbd75b5cc0b7d1c4e38cb4d4", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928160, "uuid": "e365728b-c336-4cea-a58e-231dc1f81f3d", "comment": "Malware payload", "value": "aed706f7f2f4472a60bd62540e9f13c21727a472cb565c6ee1faed91aba941f2780ece2a3eca49b087e96bd12f62d56b", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928160, "uuid": "ba3e44ba-f636-43b0-8b92-49fd0b5c3c73", "value": "T124272297C326646F007947F964B12F5E2BE28E74610CA4613BFD261AE882D0E136F5FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928160, "uuid": "b6a08237-f510-4f2b-a2a0-a7afd284f614", "value": "49152:KPucHwUOPucHwUWPucHwUZPucHwUJPucHwU0PucHwUOPucHwUxPucHwUQPucHwUO:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928160, "uuid": "c1830e2e-4877-4fa6-a40b-08fedac89a8c", "value": 21851524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928160, "uuid": "31a93d29-e10c-4bae-95be-468cace60eb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928160, "uuid": "f1718c31-2bb9-431d-9577-d0632ffcbb3d", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd11320-3f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776987596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987596, "uuid": "76521b24-82c4-45fa-a486-89e464574c26", "comment": "Malware payload", "value": "69de63bbeb813439f9411d0d093884f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987596, "uuid": "05221a0c-3a4e-489c-8fdd-fb24c4e37059", "comment": "Malware payload", "value": "e93cf6557d42cdd7657d6571c0afa5b5cee17e5dfd2838f2f18a01a4e55788c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987596, "uuid": "970228bb-94cf-4aca-84eb-a49e33f9565c", "comment": "Malware payload", "value": "46fee33da5fcdd37edad732b486a61e563c1b120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776987596, "uuid": "1e2811c4-cce1-46fc-8401-1c380824087f", "comment": "Malware payload", "value": "b783914e4051b3a088104c6cdf83cfc24e6d7e6550ad72e9dbb12f23927b5d8ec19f3953a02ad35b41f2344d5456a64d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987596, "uuid": "97966b1e-17df-4853-857f-04fcf6d66fab", "value": "T1C493F74BAB1D0B47C0A72AF03E3727F4875EBDA101A446C0611AFEC143B69F57156FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987596, "uuid": "7a0acdd3-7a06-41ab-97d4-fe62518ee426", "value": "1536:2gbIT3nmh9judrfjWm/hjhuu7x7wKjkkHM2y9QFgdJiutEha:2gSXEBkff7M2WQydOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776987596, "uuid": "b607598c-2ab2-437d-a620-f65dc9224ebd", "value": 91172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776987596, "uuid": "329bc20a-a6b0-4eab-a7d0-a9f3b8425a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776987596, "uuid": "acd1a445-5de1-4c6d-892e-b11f30d3e398", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcf3bc3-3f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776941589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941589, "uuid": "c7f10753-8108-4a87-989f-eef3811b432e", "comment": "Malware payload", "value": "6af0ad6ad3da6a502b6d721b2be73188", "object_relation": "md5", "Tag": [ { "name": "chrome-extension", "colour": "#B605A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941589, "uuid": "39ac5948-cf9d-41c5-83ae-3efcbebad773", "comment": "Malware payload", "value": "ea6b56619ab9b14597e5ccac123cc68c8ab0ee9edbf10aa344e8dccc3bcc7f67", "object_relation": "sha256", "Tag": [ { "name": "chrome-extension", "colour": "#B605A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941589, "uuid": "d9a1ca12-be75-4b96-8e12-56a2ae05c004", "comment": "Malware payload", "value": "6ce7e8513d09fd94f370f3f859108d4ccd5dd9b9", "object_relation": "sha1", "Tag": [ { "name": "chrome-extension", "colour": "#B605A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776941589, "uuid": "c9a811cf-5109-44fa-bb40-57b4c9ffa899", "comment": "Malware payload", "value": "29c6514384855e77f1e1c20c06d67e6bd0262d83a5b512cdf5db0b44bc9efc0de25789c119b1f462bf419f87e65d8b30", "object_relation": "sha3-384", "Tag": [ { "name": "chrome-extension", "colour": "#B605A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941589, "uuid": "8709cf06-0a83-49c2-a221-20148285b551", "value": "T1CCA3125C09DC9016D00B4DF48AE2409ED124969630F67A8733ED6C5CDEEEDA9CECAB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941589, "uuid": "6952f9f3-963d-495d-bd48-8a1a545d8bb0", "value": "3072:xfwu65IzyrDolSLwEHXQNpm45Oh30VnsGHBL2dF:tQ8FOwEHXOA45Oh30lswodF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776941589, "uuid": "007aa71a-d33e-412a-88ff-1b6cde2c0972", "value": 104472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776941589, "uuid": "92b498e6-b1c8-4a57-acbf-2d6e92b13336", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776941589, "uuid": "7c88c462-a411-4f43-8e86-0259dbe10c75", "value": "adoptmepetgen.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b201af4-3ee6-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776929424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929424, "uuid": "2b4d11b0-7e5f-4769-8182-dd36ac4ed839", "comment": "Malware payload (Koadic)", "value": "ed25e3eae50e1a2968fcfdb545908124", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929424, "uuid": "b6c4d393-dcc2-4dd1-84c6-d97f9c913092", "comment": "Malware payload (Koadic)", "value": "eab7651a0fec6c7fe5deca87a6a0cfddb4d7ac655c2f3bd1182126588501e30c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929424, "uuid": "5d8f19e2-b6cf-4c8c-bd83-3919033807f3", "comment": "Malware payload (Koadic)", "value": "4246ec86fbba21c7f39c3906445b53fb09a2a3fe", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776929424, "uuid": "0cab33b3-1801-471a-b96a-73e8c267c0ea", "comment": "Malware payload (Koadic)", "value": "f45af90107471e6871038cbd01f7611773fc6a4368596a33316ba2f5638c3f9ed27df404112252d7c828fc0066cd973a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929424, "uuid": "106f5437-d69f-4fcf-ae31-58b486898454", "value": "T1CFD195A6D6EB1B1B20A74955E983F826D845403F913F1AE7C3442E3EFD518BEA04F6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929424, "uuid": "99758ca5-c021-4a62-808d-803f389e5a85", "value": "48:mC+xB02+hzt9M49+f4xkZGqAS21rAMzRtnEXjmhZo0WrJ2CJG3uRcWtfyCvPmM6r:FDdETvpMaNmVSkayTYfiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776929424, "uuid": "22a03316-2b08-41a2-8c5c-de176f966942", "value": 6485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776929424, "uuid": "0c245c1e-29d3-474b-bc83-7ca2b96e9eff", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776929424, "uuid": "dd41c6bf-d169-426a-8826-e089bdb091f2", "value": "AMAN_SENDAI_VESSEL_INFORMATIONS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ad056b-3eb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1776910217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910217, "uuid": "32233e5f-9cc5-4231-bf69-a96650dc6d0a", "comment": "Malware payload (Loki)", "value": "57e2d4450641afb778b17a9348ae707f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910217, "uuid": "13b4a0cd-8018-4bc8-902f-3d5ba21e83d5", "comment": "Malware payload (Loki)", "value": "ebe53bdc9a171b425a091131e45c9119a8652b57fd00c08c8f7de300a32092af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910217, "uuid": "c4e147eb-c8af-4368-8c40-0b8d5dadfa35", "comment": "Malware payload (Loki)", "value": "0e27a306c5405bdb305ff2a3e458f35340e11b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776910217, "uuid": "605b76ef-c6e2-451e-ab7b-7af3e6ea273a", "comment": "Malware payload (Loki)", "value": "55f359085db3d34ddc94fbce71ee66d7771e5b987ef4353e3409176f80cbba3c8005a6a36740e387603abe8440eeca5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910217, "uuid": "d46d04ee-c067-4fe3-a511-9dbd78869bb3", "value": "T1DFD47C22B2B08837E35726388C1B466C9935FD3039355EF52BE42E4C5E79681792B3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910217, "uuid": "85cdec57-5543-4f73-8991-3f436b38b675", "value": "54c7b2b4961417e61f4eb420e8919a0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910217, "uuid": "68ba5e96-4018-49e6-8a9c-576cb47966d0", "value": "12288:8+oEq0s5cckbOhGUsdvSIEDL2vngYV/cTVdD1NiauRHBhZI0P1:X3q01ckAW5ED3YqxNiagHBh+0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776910217, "uuid": "ff41f270-478e-4780-ab09-e570d91fc99f", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776910217, "uuid": "1eca9d3d-7157-4ec4-89ba-f70345bcba9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776910217, "uuid": "fa0b51bc-1a7f-4f0c-af11-93d43f84c2b7", "value": "57E2D4450641AFB778B17A9348AE707F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd916c1-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776985557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985557, "uuid": "2d9496c3-9f1d-490f-a993-2a485da46485", "comment": "Malware payload", "value": "754ae8049d361e80cb2abb82d92525b0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985557, "uuid": "62a28cb8-2744-4219-83f6-a5cc8dd40cb4", "comment": "Malware payload", "value": "ebef3616c22d799c05fdfbeba18dbfee0e0f2366cc6fd54d202e079890190537", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985557, "uuid": "9d9fbcbd-cd69-4cd1-ac98-5fd203a26249", "comment": "Malware payload", "value": "18748dbc074db5ea84b3f4a37529944e2a3b465b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985557, "uuid": "06cfc9b4-ef12-42d8-a1a7-737f74e9cd9d", "comment": "Malware payload", "value": "620196bba60b26583daba317cc5ee753178a8d8c0d73081b8065bee839cbb282746de9e14d43e02180905b7472eeafaf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985557, "uuid": "e26fdffe-a375-47ab-80a7-b479e4f68830", "value": "T1B8C312215FDCC85BD1EBEAFE200FF5C8B53BE4F0B1AA5941A772DCC5241A0449686DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985557, "uuid": "1b295292-ab83-4ef5-bc1d-182d61313915", "value": "3072:CGVgl0qi+Z4O+VKebnGZfg6whYZPkaxPiT51gGDNfbIPX:7GlRFZ4V0ebn8fuYZPxPFGJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985557, "uuid": "57470905-1149-4c98-b2ca-d0041d269273", "value": 122888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985557, "uuid": "27b1e537-14f7-4d22-bc7d-4ab18a02a2dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985557, "uuid": "208c06de-62e8-4aee-8129-8c62b547387c", "value": "Democracy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23f0885-3f54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976842, "uuid": "ad7c5247-1efc-48f5-8d30-443ca814dfaf", "comment": "Malware payload (Mirai)", "value": "a85a8cf870a94baef79dc891bf90c0e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976842, "uuid": "a9b97d59-480d-428f-94f4-5c5b187c800f", "comment": "Malware payload (Mirai)", "value": "ebf23be4c26525586818845635b754c803437cc1bef42f8974d8f0e087b5edbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976842, "uuid": "7eb95ea9-4e7e-40d3-bdd0-9cf32a21a31c", "comment": "Malware payload (Mirai)", "value": "b351902e59b1f99ba8d3998745d3bc94086c39ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976842, "uuid": "1d52d40b-3521-4762-8730-abf07e48fc70", "comment": "Malware payload (Mirai)", "value": "0ec130f1573c17a34c9a6b9870556548a8d515a7329fc43df68d03b9fefe6fe4f9852506179936be53284b1d93ad6110", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976842, "uuid": "c3ea883f-48a0-495a-aeb1-4f6a78572b07", "value": "T1C4936CC4E383C4F6ED5A01B29437F3365332E83A5019EB96D369DD36DC92950EA1A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976842, "uuid": "85e5fd7b-93a4-46da-9474-888fa861610a", "value": "1536:DPCfZDf59H+l06J/TWsjsFjpTx2H6FkBhSXXhr:DPwZL5N9MTpcdTxo6eoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976842, "uuid": "1963245b-7631-4271-8ed5-e6795343aa57", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976842, "uuid": "c91b1c6e-d6ef-4947-b4d2-60ddf22d2b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976842, "uuid": "39e85900-0ac2-4414-a143-c38b5addff7d", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a741f9d8-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924425, "uuid": "460262ba-8ba8-4d54-90ec-46274309400b", "comment": "Malware payload (Mirai)", "value": "046f869fc6de3a27f9cc58e021b6a972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924425, "uuid": "c5549f7b-ec88-435e-9e8c-12cca253535a", "comment": "Malware payload (Mirai)", "value": "ed4d63c971c571466b92a24d8aedf820eb39c380aad90e3c17b3ec029a83c7cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924425, "uuid": "6c2ab562-7eff-48a6-9283-21f7354bbe2b", "comment": "Malware payload (Mirai)", "value": "1319973f0c8a32dee3806a165e43d16ad042b89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924425, "uuid": "19177ddb-69bb-4bd6-ae8d-ecca51c5c31b", "comment": "Malware payload (Mirai)", "value": "74653c39b6f840b9d2d1ffca10b5a0854cb6710273dfa8f6c9df8bcd501b872e33bb5f9b9f91ae15a7d99275fb2f8794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924425, "uuid": "ed5daaf3-0c8c-42e4-8004-46b144f3ddea", "value": "T156B3B74E6E318F7CFBA8C33857B74E21A35833D626E1C685E16CD6011E6024E645FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924425, "uuid": "1b9b5727-184f-484d-a8d4-45df33315a56", "value": "3072:xTe1KyHpLXtdrOCaOsPI7ReCzwrj5/aaNpS:xkLlddrOCaO8I7ReCkZiaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924425, "uuid": "c6ef8893-15fe-4bb2-9371-47168edeeda7", "value": 113996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924425, "uuid": "f1e14566-9264-4323-a072-7c2bfdbd1d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924425, "uuid": "18673e84-2635-4c85-a1ba-82c1fd0ab49f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c571e5-3f43-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776969325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969325, "uuid": "04ac5585-eeb1-4885-9c29-aa59dce77db4", "comment": "Malware payload (njrat)", "value": "03bc37c41f16d9d57995345f18a4aa4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969325, "uuid": "5fd6054c-ea3f-4542-a266-98deebf40336", "comment": "Malware payload (njrat)", "value": "ee000adc82a8b416383531a5fa34bd319cd674801fed5735db5da2018d658437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969325, "uuid": "da8549f2-97e0-4c0a-b9a1-dcf128c747da", "comment": "Malware payload (njrat)", "value": "c067f8eb183a9dfc9cd455a882dccd9929cf1da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776969325, "uuid": "79c48505-7189-4815-a1a3-3a187b0a114b", "comment": "Malware payload (njrat)", "value": "98293987ddd1cd8fe4f77bb52ca77b4c461f29870d6a6c2fbb76ead1ee935c6ce8a404950c22d3e095f73aa3035017de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969325, "uuid": "c44eb785-c76b-4b95-98de-9bd25648260e", "value": "T17493D84977E56524E1BF5AF75471F2004F34B48B1602E39D88F219AA1A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969325, "uuid": "2e98a6e8-9e2b-4f39-9736-a69126e84804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969325, "uuid": "2c821e1c-d9ba-4430-bc40-940d5d30be85", "value": "768:eY3AdBnkpjTMpALPGMtsas88EtNXhe9Y1mxCXxrjEtCdnl2pi1Rz4Rk3XsGdp4gM:CdRkVbPGHz88EbB1pjEwzGi1dDDD4gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776969325, "uuid": "95ec4ec5-8679-4d3b-a29d-f8698cdc107d", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776969325, "uuid": "f82a31e8-7cd7-465d-9c08-51cc62f3e1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776969325, "uuid": "28f660ce-4841-49f2-97dc-06c3a85a336a", "value": "03bc37c41f16d9d57995345f18a4aa4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0a2158-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982175, "uuid": "3abfc31a-6c18-42e9-8c97-f52bdc4bbbf3", "comment": "Malware payload (Mirai)", "value": "2778ca6c7fb77c7f04285e2feea078d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982175, "uuid": "4643e198-43f6-48f3-b717-fd1e8420be9e", "comment": "Malware payload (Mirai)", "value": "ee2383eaed43f5ff5f6baeb090e01ea5f38cf1b01dc15618b1e064328cb24403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982175, "uuid": "196dfd7c-a71e-4628-8cd4-df712f66308d", "comment": "Malware payload (Mirai)", "value": "8a96ddc002aca44d65adceca7d1c94c22a877b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982175, "uuid": "951e0223-689a-4d83-8571-cee7488dc101", "comment": "Malware payload (Mirai)", "value": "fdc2e15c1318caafeceaf66f48a6119f08b21931d210d0bcaa3cd99466183048255af3f32836fcedc57931952656c1c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982175, "uuid": "ada89a7b-c21e-4f51-8dbd-4293490123e8", "value": "T10F837CC5F783C4F1EC9305B2503AEB369B33E0BA1069EB47C3699931DC52911E616BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982175, "uuid": "d9e99e14-5910-49e7-a39b-729529f4b05d", "value": "1536:w9dSNhnFHpZqwGLcSaDwmdxWxVYOAS3tghx:w9dWnFHpgvGDHPWDD9Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982175, "uuid": "2401fcc9-03c1-454a-9eac-369d1261055c", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982175, "uuid": "8b5dc91b-368a-4f46-8c7e-e8f2cda4089f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982175, "uuid": "0cb05c39-2d91-4b07-8b49-1627fffdff06", "value": "concakhbtandhuy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7a583a-3f61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776982146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982146, "uuid": "0bbd0635-0011-40b2-b8f6-52f6fd179fd1", "comment": "Malware payload (Mirai)", "value": "7c0daf97db4b2f711d62f73f7ca2a401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982146, "uuid": "65032434-ac93-4231-8368-e2179359c960", "comment": "Malware payload (Mirai)", "value": "ef444799aba5d5230195090c9c336a80695aaa0f0fbc2240bc886bfecec9ead6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982146, "uuid": "b82114d3-f570-4119-8d32-76405c963642", "comment": "Malware payload (Mirai)", "value": "ca4a6394e2204e4d81cafad6fb0ed7a388e09600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776982146, "uuid": "5f7c3371-9e46-46e1-953c-4d23aa50d341", "comment": "Malware payload (Mirai)", "value": "76ff2ff591a52efdb411727918a6ead4285fed21f4d94e6988a4accf53c78a32bcb2fe0904b85074858dbb17f576ad54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982146, "uuid": "d63a1e8e-36cd-4995-9b07-d7d0ef9e5c9b", "value": "T1B7B36A72D8296E58D165C0B0B0F48FB92B639AD092875FBE15B3C2745083D8EF585BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982146, "uuid": "dc81974b-7505-4f4f-b66a-24348b395dda", "value": "1536:G18VAch2QBpafxVxh5Z+okCNKUw1KeXf8KXXAGWOrp7X8QXLI:G2BdBAZ+oklUW8KAGW2p7NXLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776982146, "uuid": "1ed58f6a-6b23-49f5-ac35-6aa5c7ebcff5", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776982146, "uuid": "1fb5da5c-7451-473f-a6f2-547b21dfeb0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776982146, "uuid": "a6e3339c-8af8-4e5c-ae09-38a451a7a154", "value": "concakhbtandhuy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6483eb4-3ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776934409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934409, "uuid": "9f7bc05f-e7e5-4b3f-a1e4-c57316c5f1b2", "comment": "Malware payload", "value": "5ed543af8bbc8cad5824aafebd0387ac", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934409, "uuid": "341f3a3f-fae0-4252-aa94-c11b857281f2", "comment": "Malware payload", "value": "efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934409, "uuid": "e678639b-ef49-4e89-b095-c3cc1d7b04ab", "comment": "Malware payload", "value": "88b103b8d907b3df3910836092d57632ef2c74fa", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776934409, "uuid": "d0dc8395-8c55-4c3e-9a5d-fe4ef336632e", "comment": "Malware payload", "value": "5e9b486e8875dec97d50ed92f70de9ce13f16c462ae34ecd897075dd21272d936b469f918193e986c8cb580111bf9243", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934409, "uuid": "df26b93f-3a14-4638-ade6-dd203a423da0", "value": "T154524CA039091EFB67EC209244C94A2D4A6C266CC9546CE32FC718E73C1DB9C27B78F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934409, "uuid": "cd34f9fe-b2a2-4bf4-8dd1-f96e91fd4da1", "value": "384:WP6qEZoVtfxxSoC9TAXfBVSkV8/nDgHbxpt:uyZo7JK9sX5Y9Qpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776934409, "uuid": "6c2d23ab-b6f8-430d-b406-2a210d12424f", "value": 13933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776934409, "uuid": "f0bef4fe-401c-41bc-bc2b-4ce5e700ce28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776934409, "uuid": "612a83d3-8507-445b-b7d7-fbf73b95d71e", "value": "efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daff9c7-3f24-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimwolf)", "timestamp": 1776955950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955950, "uuid": "b46acb92-ffe2-48ff-89cc-11269c7c5cdd", "comment": "Malware payload (Kimwolf)", "value": "7e8131f426a8a17f62bb72a31dfdba44", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955950, "uuid": "1e43be1f-d64f-4a23-8493-ec63ad559ecc", "comment": "Malware payload (Kimwolf)", "value": "f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955950, "uuid": "6f4f35f5-dddc-4db0-b4a7-7b5134861ffb", "comment": "Malware payload (Kimwolf)", "value": "fc5f1c24a93475cdc37ee46b10ced608e63463e6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955950, "uuid": "27441033-2ecc-405d-807c-9b2d61f8610a", "comment": "Malware payload (Kimwolf)", "value": "37adc6fab0113ce0c8a03c28ede59a0833a08b96ee3bba118a3634cffd96e5715cedef6b37a97a358b01278ddf02ca6b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955950, "uuid": "c774a536-fa40-4a8c-8f89-0e319b6c8713", "value": "T170F53335F47407ADF165563224FB63D2E29EB81BE581414AC7266897D00FBFA8B4FAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955950, "uuid": "aabe608e-e4b0-494c-bed3-c5f46195e463", "value": "98304:5REdprKUJtFiWqXMTjoCN22X7Zfz312WmU4IMmhMAUIgODHtz:5X0iWqwjNXj1CtIM2BXg2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955950, "uuid": "770bfc70-c10d-4101-bd5e-e5be87d12ac2", "value": 3425727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955950, "uuid": "e21f1813-39a7-4231-aa69-8a607c062e8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955950, "uuid": "a8c4e2bd-5202-4048-8f25-84bab9506b86", "value": "f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0debde12-3f41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968406, "uuid": "5972f9cb-e5c5-4e54-842c-0abe78a2f5bc", "comment": "Malware payload", "value": "07df336a588ac554e9516985632668b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968406, "uuid": "1e6e958c-0b0a-4313-b351-d2f847afeaf4", "comment": "Malware payload", "value": "f19a8bd4ebd1ef6c60f3e83d04638beb5ef4a51b01fa6d5a68d565bdf0b46219", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968406, "uuid": "92b442f3-8522-400b-9e01-72bf0083d52a", "comment": "Malware payload", "value": "e5e7e750647ada2d81f16d444d00ae1d60855f46", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968406, "uuid": "ab5792e2-cfc2-4cc6-bdf6-9d2ce670b055", "comment": "Malware payload", "value": "7c8bc524934b8ceab6c79a8b238d17907a24222850122f6759db456aba646661d01481a1028e2382c21a02430406d0c4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968406, "uuid": "8de03e3f-dd38-44db-846d-c52e799aa845", "value": "T1749612D6FBD8992FC4771173CD7A46F215864C1289438F576A48331C28BBAD84F8ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968406, "uuid": "3bacc3b6-744a-448d-b2ef-1637f18603a5", "value": "196608:gpRLIx6UXqeVzEwXFHvRDyhxPmwlpG1rzOppILgpTF:gpyxAwX9vFzKpWKppIUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968406, "uuid": "f05a0b30-32d6-41b7-bada-d38b21f12c23", "value": 9355654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968406, "uuid": "0d423ef3-6849-4d0c-9c5c-186a6bf82cf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968406, "uuid": "4772a717-04ad-41e1-903d-2c9cfcee8d19", "value": "f19a8bd4ebd1ef6c60f3e83d04638beb5ef4a51b01fa6d5a68d565bdf0b46219.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e951f2a-3ee3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776928169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928169, "uuid": "e8d3a5c0-7a88-4ca1-a2c2-6069e12c79b5", "comment": "Malware payload", "value": "8c980131fe1273b74b733a81c5308f8a", "object_relation": "md5", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928169, "uuid": "3d110115-f538-4912-925a-72fdcbb03642", "comment": "Malware payload", "value": "f1b41f10fb4068d8df39124b31a933dab9ee6c9f3fbdd95b67794a07dd309660", "object_relation": "sha256", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928169, "uuid": "1e7459ff-6bbf-4ac2-b70e-ec58b95691a7", "comment": "Malware payload", "value": "55321dc90d192a48a5b25a9002c38b665eba69ec", "object_relation": "sha1", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776928169, "uuid": "a5812230-3dd8-4e57-9cf2-bfe3d57fb78b", "comment": "Malware payload", "value": "0fe4b8456de68f9a8e2744f4fca73d8d04323d17ee8f6c29d07da83cc0b6d7abfa40fe4612382441b14e98bad04825e2", "object_relation": "sha3-384", "Tag": [ { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928169, "uuid": "c749781a-30c4-4c80-8649-a0c234040f53", "value": "T13B2723E5CD88B77D1DE8521C642E7F0F6092CE4042999FDA326759CB808DD2E36BD1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928169, "uuid": "daf757c4-e905-4f67-8c1a-c67092a022f6", "value": "49152:/0o7JJnn0o7JJnF0o7JJnb0o7JJnB0o7JJnq0o7JJnY0o7JJng0o7JJn60o7JJni:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776928169, "uuid": "50d9121c-c5a2-4cf1-8791-0add0704519f", "value": 21371502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776928169, "uuid": "14cc0462-d87a-4342-819c-3d0e4f5fff41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776928169, "uuid": "36a28f4a-fac8-406e-9f17-8b7f6d520304", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e81b1b-3f68-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776985388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985388, "uuid": "ea0a0cb6-3a29-48f2-9813-498a6f09c920", "comment": "Malware payload (NanoCore)", "value": "3818dcdb66d88345c7d73531c8ffbe5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985388, "uuid": "c9632c67-a8ad-4335-a702-e973ad0fe6ac", "comment": "Malware payload (NanoCore)", "value": "f24d4f352a282a73c98a5c56224468e46f48925cce1058b3090d160a3eaacb21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985388, "uuid": "6bb4386e-2de5-4c12-8aa5-95eea75ee429", "comment": "Malware payload (NanoCore)", "value": "97b8a8f7751054f869636adb028b87295971defb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776985388, "uuid": "78ad1bdb-64f6-453c-8af4-c8ba999e2aff", "comment": "Malware payload (NanoCore)", "value": "d96976548652276ae4efa218d1fe4c19af5b2f4071ef9b85f1be09c75a45fafa4eb72481d0b766957ab1abdcfb8f4c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985388, "uuid": "4cd36687-2393-4a22-9eb8-74c208080e9c", "value": "T10414CF153BA84A2FE2DE867A711252168779C2E3ACD3F7DE28D415B34B663E406071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985388, "uuid": "481c92ba-7512-4455-8fdc-7ef83d86f893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985388, "uuid": "402c8e48-9ea8-4a2f-b988-4d513113e3c9", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HISPNIVUe6XLZRrXzELuY0BWsHn:QLV6Bta6dtJmakIM5LNIL6XFRHOsH+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776985388, "uuid": "66d602b9-77f4-45bb-ad34-6723fa6f9389", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776985388, "uuid": "fcc5ce63-57bb-4891-9c4f-4a1919fafb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776985388, "uuid": "a803205c-10cd-4ff4-80ec-2c3169b0b8f6", "value": "Dcm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4558aabf-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776931133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931133, "uuid": "1d89c0ac-019e-4e11-8ff0-0d00857a4552", "comment": "Malware payload", "value": "ddf83b5a0aa5cceed83cc5387ac89f3f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931133, "uuid": "1141a2de-9e21-4231-85bc-ca1cf5e7e019", "comment": "Malware payload", "value": "f2872e9d6ad1fdfba1dee70ef05c58b8c8d65ec3947c9044921b5fc49aaa9b63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931133, "uuid": "2158541a-827e-4c7c-ab3b-a299d746273b", "comment": "Malware payload", "value": "e857e87f60cb8e2d64ed3daf02be8fac8edf42b7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931133, "uuid": "777e3df2-da57-4d1c-8ccb-00e348ec6973", "comment": "Malware payload", "value": "2a60b4e404775735495fa64c5cc1ac0f066df44a7a740617321d8b48cfd98319ce4896ddd794bf5e4e61de8ee2fa02ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931133, "uuid": "a5ac8c3d-7ae2-43ba-a012-c3c85c1ccd23", "value": "T19D137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931133, "uuid": "bf92d2ba-4891-4336-8963-011dff370026", "value": "768:bB+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bB+wcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931133, "uuid": "f6b9414e-a4e4-4d99-8c6e-a793bbef095b", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931133, "uuid": "9fd512d8-20bc-417e-862d-167bb5e449dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931133, "uuid": "46fbeff3-28c0-47a9-aa86-f1be5e23d92a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d3627c-3f01-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776940930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940930, "uuid": "5c494f17-f475-4078-913f-ff8a978283d5", "comment": "Malware payload (DonutLoader)", "value": "3850f8b8f4d3e74400f3553148828ca3", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940930, "uuid": "ffa892a3-450f-4f8b-89af-dd3404160461", "comment": "Malware payload (DonutLoader)", "value": "f2dafd7e3e06662ac88d33bb28ed9f08785dfaadef0aa233d1ccca193501b13c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940930, "uuid": "9973546f-6083-4dbf-ab79-2fe0c14b9c5a", "comment": "Malware payload (DonutLoader)", "value": "7766e67b4e641191cad858df1c60e8840609c64a", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776940930, "uuid": "e169bc82-ac0a-4dd8-b041-99619d144f00", "comment": "Malware payload (DonutLoader)", "value": "c8bd49284ffe9d97f730fdc14add08d4d201e465405120920617ec4c2c2d5795fd9321b22d72522897d873830516e1e2", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940930, "uuid": "dbec9ae4-135b-499c-b53d-3c824ee8eca6", "value": "T1EE8422420EFA34E00F15E37A65D7299DBDE30F6585DAC47AA69D2243814AB02931FCF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940930, "uuid": "2149b8b6-07e3-4988-9d9c-42c74a585e6d", "value": "6144:+Ck5yUF0IsvkMRx+Hfx1kt8HVbh/29UZ/PwLhKK/ACjWSCTNQr8Ep:LaxER4/bktSVbV2aPKhKEA2R+KLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776940930, "uuid": "c9e47115-cea2-4563-bfbc-8615fd84c87e", "value": 373788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776940930, "uuid": "94aa1fc8-4ab9-44f9-aaf4-25baf73b41c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776940930, "uuid": "d347a8fc-2d32-4f1c-b71d-8b6bbe2be501", "value": "FILM.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518bb2b5-3f5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776979257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979257, "uuid": "8d432b26-88ae-4496-895c-1f6c4fee747f", "comment": "Malware payload", "value": "b6a201726b44106a7dbe93a480b38420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979257, "uuid": "7e5d11ee-bfec-4bf7-b52b-d6e493630638", "comment": "Malware payload", "value": "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979257, "uuid": "57aafbf5-f03c-484a-845a-95fb35693be8", "comment": "Malware payload", "value": "10dfd71cf61ea3c1621a5b0c08c3b034773fb84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776979257, "uuid": "aba0819c-ee48-4119-9453-bd9527d4f99a", "comment": "Malware payload", "value": "9e3f3b76f1ae1f5dfbadb7be2ab419b691277330f37ccae1d03bd9870c1cb34871a1963c1a79cddd151a001f465232fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979257, "uuid": "4dc59506-54b7-4a87-b7f7-34ab954397a0", "value": "T1B235490677A47FB4E29BD0BDE6324403E5F2F4385322A5FF45DA59280E27AC05935BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979257, "uuid": "9117d351-ec27-4d87-811e-dd8885a510cb", "value": "0f448f5ad25eda0d404056073b1da8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979257, "uuid": "5c0129a4-e68e-4f07-88f3-c155d266d011", "value": "12288:FPBiUxML1tCIS190GrCsXL2Ux4tMt+P7A+tz1ydyrgtD9KMB8:yUiL7iPBCs72ERt+TA+tzUAmBKMB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776979257, "uuid": "a9d2d02b-b2d4-4d92-a0a0-04af4ea386c7", "value": 1085288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776979257, "uuid": "b2fcadd1-02e2-419d-a0f7-fef1b6e2a619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776979257, "uuid": "8b179468-da78-4754-bcc3-ba88cce780ee", "value": "Telemetry.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56267270-3edb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924718, "uuid": "b95b714f-115f-422a-8da1-790d220b732b", "comment": "Malware payload", "value": "30cffe8fceef38a3599a582a2f6f8171", "object_relation": "md5", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924718, "uuid": "e051b26b-f5bf-41b9-90fe-5195790fa5a5", "comment": "Malware payload", "value": "f3c59b03861271746c6261a51ff0c14851c34f046250623109d3b38d18ec30ca", "object_relation": "sha256", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924718, "uuid": "92315787-ddb8-4124-bf31-dc32f83df4b5", "comment": "Malware payload", "value": "4bad4353df433667eed221fefd97f320048f342e", "object_relation": "sha1", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924718, "uuid": "745e4cc1-18e7-4888-b4c1-c1c20ca23904", "comment": "Malware payload", "value": "cf7c84252ad7d174a4f2b37779861831cddfa531e6bf643b7cf45d1d78072926a008f73d6154717941292aaac4820f60", "object_relation": "sha3-384", "Tag": [ { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924718, "uuid": "9e39aaa2-fa1b-4747-b275-63cdb7564abe", "value": "T1F1058EE5DDA49758E1C03B2DB335011373AEF99DA6F66683E2331B7A369E043510D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924718, "uuid": "b05d3117-50ba-4630-8b49-408f4d6b9824", "value": "6144:05y6LF94INB0X/52mN7dobzI0S9GFv5FACi/0J1nJIEsHiBEdhznI78IAH8F3cdX:0X9Vw0OuTvFQ1lAMSvc+x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924718, "uuid": "0b1a8390-d59e-4818-a90e-9773b2b4ef9d", "value": 808074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924718, "uuid": "50dd1588-c8a7-45f0-bebe-ec58e92fd7ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924718, "uuid": "280bdba3-24dc-4b83-85e2-592385341871", "value": "f3c59b03861271746c6261a51ff0c14851c34f046250623109d3b38d18ec30ca.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0551130-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776945029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945029, "uuid": "a2796fab-a737-4856-a800-7bc3ae988c2d", "comment": "Malware payload (ValleyRAT)", "value": "e311176da87d1dd41b8b3b92d5c21fee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945029, "uuid": "b5a31511-4663-4c59-862e-b787a525d0a4", "comment": "Malware payload (ValleyRAT)", "value": "f41104fbec4506499f3b3b79780a2a605eff6c3e259fc506b2799fc7077e92b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945029, "uuid": "11e11cf8-ba4e-4909-a5de-b9e516242cf2", "comment": "Malware payload (ValleyRAT)", "value": "15bf6dc25374b599dab6903dc37be72bec38ebf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776945029, "uuid": "5fd91c15-5db1-40a6-aaba-6a57089139a2", "comment": "Malware payload (ValleyRAT)", "value": "6abb3a09b4a256c0ae557476b138b5e036c0225ce9911a40a96eaa511d5fc2ef5e76d923994ea87859dfe030a5c48499", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945029, "uuid": "571d25ea-0c60-48e9-9de8-d62ee2cd04f6", "value": "T1393385947ED58CD6D910733CA0EAD176363CBAD5CA834B07A93467312B23BD12DD622E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945029, "uuid": "38ac4852-cdd3-4b8f-82b2-a2066ff119f5", "value": "18fe239909cf999ed7b297f12cb78ec7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945029, "uuid": "dc3810b6-d849-4ca2-953e-e210d215d7ba", "value": "768:PIYrZEqwoJYisQ9LookpCdhf2Ww7UCQvQ4I:A9qXCLGpkp/7UCQvQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776945029, "uuid": "01afe775-8974-4090-8e30-bde5525ea5d9", "value": 52070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776945029, "uuid": "de966c3d-4c33-44c4-9fd0-6e3581fffc8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776945029, "uuid": "c3f5cfea-4f0c-496b-9ea7-2d61c1a9df8c", "value": "imagemagik.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18015727-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944801, "uuid": "e5b7769e-0412-4e5a-8a66-f62a6db0778f", "comment": "Malware payload", "value": "f96740a694c4d9f09577fa388ec34ce7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944801, "uuid": "69d2324b-268d-4610-82bd-fa02e71a5fec", "comment": "Malware payload", "value": "f433774660d6296c130e4259fb57fc55f74ab88758132ed1a3b40fbf30966002", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944801, "uuid": "d1558ab1-f278-461f-8ca6-0f260ce31d36", "comment": "Malware payload", "value": "895ec0d58e1e4aff819a34af97a894e6c5354084", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944801, "uuid": "55dd4a6b-337c-4ca0-80a3-d28cc45c54ce", "comment": "Malware payload", "value": "1537d11a14a958451c7923e0fff1b51f45b140217f07fee548a871dd9d7ff2d43c8d8547c84a02d36edb17ff4873b406", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944801, "uuid": "76ca76e8-ac81-49be-8447-ebfc2899718b", "value": "T1C27123058BD8816AE0B70B347EB3431796B0F8E0DA724B2E0990A2656C616741EB1BB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944801, "uuid": "f6bf5633-42d3-4f6c-b017-db58111389bb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944801, "uuid": "0db004aa-5ba9-4187-ae75-69022ac97cdf", "value": "48:6XrUFFJQaIPmy3vyJ95m9eb91ulyGa3VFq:+UFFeaIbJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944801, "uuid": "1e189480-e3a9-4ab6-a24a-ebdb27507315", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944801, "uuid": "415405ae-2ca9-4fb8-b791-f12ebe47b873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944801, "uuid": "b16c2d63-dd83-45d8-8e58-b39809845675", "value": "mv5al0sa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94be711-3f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944319, "uuid": "44a6faf2-b4c2-4a0c-ab68-a58974020966", "comment": "Malware payload", "value": "2731b3e8524e523a84dc7374ae29ac23", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944319, "uuid": "542c0428-7628-47a8-954d-b3326f45f579", "comment": "Malware payload", "value": "f44fa352c430d5f34462143daa726660be9d1bd0666ab2f3672df47adde55986", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944319, "uuid": "eda9934b-90ac-4abc-82c8-f70e4767a303", "comment": "Malware payload", "value": "9a2a3126c6045edfe6d366939b201181da456f4a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944319, "uuid": "e5df1e98-e02d-48e3-b370-2e3f826eb711", "comment": "Malware payload", "value": "29a43c9d6af526918b0d9d9a93935b452cbd6c3d836396bac1632ac5149d550509f0d47c2939db8447b6fc8bba5597c8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944319, "uuid": "2099278a-cdd4-4542-a9da-1614e20ebfbc", "value": "T1A741AC1567FA031CF2F74B396ABFA252997AFD05DA229B8D0105608C0870E20D971F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944319, "uuid": "a45632c2-f106-499a-8ae5-f26b19908519", "value": "48:8wEfRSnkc+6Ym1tP0KZyKZuYZzNdWeHbd0dTdDabiMH:8wEfRDzOkspdBHO5dDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944319, "uuid": "e9abe99c-c605-4d0c-b87d-8b7f3c9e0a04", "value": 2273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944319, "uuid": "c6babec2-cbbd-4eaa-a757-8141d7bca2d0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944319, "uuid": "2da96714-5601-4531-9eff-aa75e5868be5", "value": "f44fa352c430d5f34462143daa726660be9d1bd0666ab2f3672df47adde55986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74380f0e-3f3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776966001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966001, "uuid": "37e72939-2a2b-44ad-9ae7-bb93e3d47df7", "comment": "Malware payload", "value": "818a831c58c4861008bdc1cce7b906b7", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966001, "uuid": "9197c4ad-ae5f-4853-a0d6-14c0867b6782", "comment": "Malware payload", "value": "f4ae346deaf87fffdbba0086a29c00819df99cfb380bd08f1da60e45e76b1b63", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966001, "uuid": "bbdf701e-14fc-43cc-92d9-cdec27c69659", "comment": "Malware payload", "value": "3aad81e6fb7feafca6d56a343fd8ef183d7c77f8", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776966001, "uuid": "39bc1d6d-fa67-41a6-8781-7d3bbaa82b93", "comment": "Malware payload", "value": "9fdaf06ed71af2d5779e7c1f3a067d736c6c8d0bc9aa8f5f511f9bba7fbb2baed86d2951efd1d0ef24b6a8db638e5ed1", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966001, "uuid": "cfd6feac-ece2-4047-9d22-065fdd5abbfb", "value": "T1DDC3396AB2E01198DBB581F6D9921706EB7074751B15A3DB2BB853B31B2B4C68F3C3D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966001, "uuid": "ccef0db3-a3e1-4ff2-a27f-654706d71bf7", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966001, "uuid": "d8853e16-ad79-428d-b6f2-2c6c8dd6d631", "value": "3072:i2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX9Ij7bh:DbJhs7QW69hd1MMdxPe9N9uA0hu9TBYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776966001, "uuid": "3131375d-31fe-4752-be42-7041aac30e5e", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776966001, "uuid": "380932fb-b3b5-4feb-b856-442781d3276e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776966001, "uuid": "d376cb20-e182-4e35-99b8-3cbebfef350f", "value": "TelegramFix1df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4f9100-3eea-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776931149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931149, "uuid": "48a0ee54-e357-472f-b345-62f248782c0c", "comment": "Malware payload (RustyStealer)", "value": "876ffb74911d53b5f11f4402c4b9101d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931149, "uuid": "944457c7-1d83-496c-9dde-24782e089054", "comment": "Malware payload (RustyStealer)", "value": "f4d90ff9ecb42992b39441134050036b3079b56229b8310f13384734994c0ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931149, "uuid": "23c318fe-aa2c-4cd4-867d-9100fb5d0ac9", "comment": "Malware payload (RustyStealer)", "value": "7265352c8f68bfbe06604bcf3b105239b6d90d48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931149, "uuid": "2cdeae77-1c98-4c1b-b422-6265523272c4", "comment": "Malware payload (RustyStealer)", "value": "dc45cb502c437b25012e433448942bf57e0333335598d9e19534d9a787f2a761a06b62015dcbd77b612395684d31bd14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931149, "uuid": "0bf21427-c653-45bf-a187-a9856ed554bb", "value": "T154266C026E8A48E9C09DC874C3478B634E2234DB1A36F6BF45C552293F6EBB55F2E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931149, "uuid": "6445f472-f0e9-467b-89f8-6fc91afdc026", "value": "ea3d1d21546ead5341643831cab43240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931149, "uuid": "99dfd5b5-68fd-4c53-9397-d282b0737bf0", "value": "49152:hDR848nSO0Cg/kBgCIMAJy27ngXMaYZsx9DG6Ic+rEsNZn8vDr3wkev1Ysa//I0O:PygJcKdjrEmUwQXn+wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931149, "uuid": "db0ad907-df34-4b35-a841-2fb37f14fd08", "value": 4599296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931149, "uuid": "616fc79b-8c0a-4356-924d-809f4749cee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931149, "uuid": "2239ee2f-2bb6-4746-b748-b18df5761242", "value": "f4d90ff9ecb42992b39441134050036b3079b56229b8310f13384734994c0ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e83bc1-3f40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776968332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968332, "uuid": "74d2a43b-23a9-4db3-891a-eb55f830edcb", "comment": "Malware payload", "value": "f6e67b52cc58c60f1dfb7e90e6013853", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968332, "uuid": "3ef262c3-b9fe-4176-b533-beec28a69445", "comment": "Malware payload", "value": "f4f39a97845c67f655e7fd69aa5bb1b1809054bdebc7cd06cec86345e93e1d65", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968332, "uuid": "93fc024f-9e5b-4c06-ba2d-434473b01fa5", "comment": "Malware payload", "value": "e4d18af8292bc4b8c3b6d403eb9e5717aba11273", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776968332, "uuid": "f122c7ca-b5d8-4a7f-a162-13db9ff44fc1", "comment": "Malware payload", "value": "9bca75bb7f9779f878b878561ff2db79794083fbc178143ab128f49e4bfe3ed0f8e30889ff4cb19aeb6ad07e744ab6f7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NGate-Spanish", "colour": "#C0F701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968332, "uuid": "d61835ce-a756-4d94-b659-85e7a18beb37", "value": "T1AE06018AFF59952FC87700320F6A437636528D168E839B476858332C68B7ADC4F5DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968332, "uuid": "7121b633-5990-4f4c-bae8-b9dc186fad42", "value": "98304:a6gh9+IPljQ6c4RxVX++6VKdxr+LGw5i+zh8JWtqBqJ3++Eg:ehdcUXjFxCL55J+QEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776968332, "uuid": "ecc4dea1-f430-4ea4-ad05-ec66ef4b9ce7", "value": 3945048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776968332, "uuid": "85233ee0-8332-4f27-8bbd-dfc5d408283f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776968332, "uuid": "27ba291b-de0f-4ce8-89f7-25472826d60b", "value": "f4f39a97845c67f655e7fd69aa5bb1b1809054bdebc7cd06cec86345e93e1d65.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c771431-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944835, "uuid": "82e28edc-1eca-4ede-b79d-b1d29183ef34", "comment": "Malware payload", "value": "a7baa1f2f44487b03692d2e67cb31951", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944835, "uuid": "b6f9b699-7abe-49a8-a1d8-3f9d25c57fb0", "comment": "Malware payload", "value": "f5915c6ab771c98cab7773af228d2e8895bb0cb2720dbf2ed22d0ed8c877ae84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944835, "uuid": "866ebaff-88f1-49ab-acb0-ce5f6a966051", "comment": "Malware payload", "value": "fa759646b7880bc0a8087a3ff8a19eb54297d3e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944835, "uuid": "1dbe138f-4a5c-4369-8230-0f7ed0ba73dc", "comment": "Malware payload", "value": "f601c65573877be4b7136052a3783bd3e47f34df67582d2cfb4c34040b7d07392b74d0355e4d47847790b4ca03b1ff1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944835, "uuid": "687d2420-e45c-41c0-944f-5323a544b8f7", "value": "T190711206ABD84267E07B0734AEF34307A7B5F8848FF34B6D05901255BC61A645DB5FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944835, "uuid": "97e645f6-6044-4049-93e7-5edf66970530", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944835, "uuid": "155dbcd9-b41c-417a-8e76-fa745f14406b", "value": "24:etGSJl/s9OAzEO3Dpo+2v/OffeZP9HC76JMTNtkZfm5moFFDst2WI+ycuZhNG2Gw:6JlQh2gIJm5mAk91ulG3a3P4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944835, "uuid": "eb2a196d-d3fd-49aa-8e21-d006d960ff00", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944835, "uuid": "8f577eb9-fc24-46ee-91f4-7bb453f4297a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944835, "uuid": "1175d0f9-db2e-4480-ac75-86f33cab1289", "value": "wnhffcaw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d98d23-3f52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976098, "uuid": "7fdd0e25-75c2-4504-a302-a620540f747a", "comment": "Malware payload (Mirai)", "value": "95fb664f6eaa3f7363f8e74c82a43630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976098, "uuid": "7151540d-9c77-4e76-972e-106ea06f15d7", "comment": "Malware payload (Mirai)", "value": "f5d683f894097284c87e3c5f1041e30a763453281ae14e2db2c9a70f7e200a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976098, "uuid": "329b6929-39f0-4d1d-874c-0afff171fd14", "comment": "Malware payload (Mirai)", "value": "05ba0d6bc4f565ec72731e157a6b238a415eb96f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976098, "uuid": "e6d5bd11-752a-4864-a24d-59cebf0dcdba", "comment": "Malware payload (Mirai)", "value": "4d8785a1f9a9e47c84045c24a9f8dee22c3ba14b1cfcdaa46eb3e1bfdbf01d8c78cbeeba12e44e61fbd51b57917a3f83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976098, "uuid": "cbc4d2d3-44bb-4a8b-bacd-29b1d1b92e4f", "value": "T125D33C06B31C0A83D2A32EB4373F67E193EF9AC121E4F644295EA68D9172D335685DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976098, "uuid": "fa6c4c62-1e2c-428e-aa03-2ecf3d814903", "value": "1536:AuJOoYEBkHFNBsVwplmH4aN9iMQwhdZHqxvgvK91v9uw3vZvGyt7ZvASg1OkkvYg:P/B0Ne0U7Tp/HqxF97jZv3tySUgCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976098, "uuid": "4fee70be-6805-4a00-8054-a06227d5347d", "value": 138644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976098, "uuid": "7f5caa4b-6520-4591-9fa7-bd2fcd97c790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976098, "uuid": "24f0c50f-fc2f-47e2-a771-3dc52bfdb054", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bee793-3edb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776924736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924736, "uuid": "3904c4de-a0d1-4691-a0d8-3e8a39ebdcea", "comment": "Malware payload", "value": "802412000bac16fe10fd0825fb7412c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924736, "uuid": "d9f48e04-643f-4842-ac81-d46847a26f30", "comment": "Malware payload", "value": "f5dee367e333e3918bff1ea2c9c0836996b8610bbfde4f74034055b3740df6aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924736, "uuid": "c482e316-db03-48d2-9f09-073482d5fa88", "comment": "Malware payload", "value": "ee47dd8b1b4d5d861b0a975b72b51c79276e51fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924736, "uuid": "76e1ffa6-f3e8-4871-ba0c-016a89021b6a", "comment": "Malware payload", "value": "951b53456caf9a49f057dd83e0db642964fefdbef21c74381639822f65d6a228ec0ca1c51f50c8ff8084abe640a68fcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "king-authdrakesotware-com", "colour": "#66DF02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924736, "uuid": "17d97a95-0791-4390-a3ac-b0ccd5ab9dca", "value": "T18C3197167813CA9F03A343AB291B00C990D8CC859A9A54C2B114FCC478EAA9D8397B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924736, "uuid": "d61ad343-4a33-4e77-aa4e-1acac63a6482", "value": "24:4qhsB1dKL9yqlyqk6QJslOMIl2u4fU2t2WTRQVDzRtWLf2APZVX+8oO:WrsMqQqk6blOJl2LU2t2W1QVptQrVuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924736, "uuid": "9c33f628-d467-417b-87cc-0afe21ed213c", "value": 1847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924736, "uuid": "52a897bc-6fd2-4d45-abda-930a014af895", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924736, "uuid": "7cebd4b9-b53c-46c2-a36f-921e2db2956f", "value": "f5dee367e333e3918bff1ea2c9c0836996b8610bbfde4f74034055b3740df6aa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341f2389-3edc-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776925091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925091, "uuid": "d91d6908-b8fe-465d-b5a8-7b24bace0cda", "comment": "Malware payload (Koadic)", "value": "50636a73f71357f1af2a7b56a82df48a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925091, "uuid": "438e597b-2560-458d-974b-3d7d20d5ec44", "comment": "Malware payload (Koadic)", "value": "f706f7d1114d89368d84019c05a01e504ab0ffc15a5d367facc27fc9dfdd2592", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925091, "uuid": "fa1def87-e328-4ef2-a2b4-a9ff5b9c8f05", "comment": "Malware payload (Koadic)", "value": "9b4cefa169f8282f1d2c2e1d884910cd9b3eb437", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776925091, "uuid": "c9da52f7-09c0-4a55-a79c-46bc1b3de45a", "comment": "Malware payload (Koadic)", "value": "6e1a878eb2340d1eaafe5e3cb6a9c9b87026fe46061abd8ec7d25e138518adc875d190828227cc52cf24f3f2c0a69f9a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925091, "uuid": "21889301-1631-4d90-aa95-3e250f64e1fa", "value": "T1AC225F268A8F295F380C8A04BDFED61C5C7CF5FE15E06BBDC7B0A9DD1542268F502266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925091, "uuid": "5228cf56-1a5f-41e0-a903-a403fd6c4a41", "value": "48:KqbL/KAWHhwOWxjMUuMU14BMUJWTMUgFWJMUggtW9WukMqM3Y6WZuWyhcIWgeUWy:nDWHhWII8gsgzkutLA7loY3HdWlCalgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776925091, "uuid": "95e56e05-7634-49c9-ab0a-b1595415a6d6", "value": 10711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776925091, "uuid": "246b4c62-b1b9-4c24-bede-222db606b772", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776925091, "uuid": "0ccee791-5e7d-4f39-848d-a85d34c83097", "value": "PAYMENT_CONFIRMATION092384567.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038ff162-3f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944766, "uuid": "ea6cc372-01ee-452e-9391-438630fa575a", "comment": "Malware payload", "value": "e13d3f39442517d409560bf51c46096e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944766, "uuid": "5900035a-9ddf-401c-8a32-79c31c42a17c", "comment": "Malware payload", "value": "f777b0d142040d59d5486613249e26ad0f79988b66d373f3be4cf761a2f30168", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944766, "uuid": "0eaf9876-a9b2-4a82-bcba-3f4ce2d81150", "comment": "Malware payload", "value": "5af0ee3c0d61d08e306f818d5778cbad40fd9aaa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944766, "uuid": "cb8e418a-1bb7-46e1-98db-15fd26fd5097", "comment": "Malware payload", "value": "6031864c3ee1810da18669e36bb562a883b52304fcb0410f1979e7b905efa6d117d8621d63ee24ba681cd27e95a67bfe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944766, "uuid": "ca3bdaac-2c6c-4574-aae1-058a603e4ec5", "value": "T14F7123079BD88527E0B74B34AEB3871766B4F9948F734B3E19504214BCA16741971BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944766, "uuid": "784b90fd-fb6c-491b-a9c8-007947578e13", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944766, "uuid": "1517cf43-40cf-4067-b73e-e81a333f6060", "value": "24:etGSt9Rz1Q5P7ZwuIjJk5UEtkZfT725moLyFDb2WI+ycuZhNSDakSjMPNnq:6dsBeJT725m+Sb91ulsa3Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944766, "uuid": "d8cc90e5-fcab-484d-9602-30b7c915fb89", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944766, "uuid": "c98f8ddc-6bcb-4b19-b0aa-55e6ef8185de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944766, "uuid": "025f523f-bd82-484a-8df8-ebd493160194", "value": "fa4xzqnz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac885a-3f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776976162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976162, "uuid": "b71b70c7-a824-4560-81a3-85e17765528c", "comment": "Malware payload (Mirai)", "value": "64f299ba00c3d2a10200639a52efadf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976162, "uuid": "c44b15ce-4e22-4616-afa4-e35da089098b", "comment": "Malware payload (Mirai)", "value": "f79318bb5986c5490dd5f7b0d563070af2eab2f87ee08648d118a0311967d0eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976162, "uuid": "07124b92-3eb3-4984-a5a8-291f559357bd", "comment": "Malware payload (Mirai)", "value": "c752d35329398362d61336ec95b4a010e64870d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776976162, "uuid": "9cd09fbc-cc13-4f1f-884a-7448e7fb6962", "comment": "Malware payload (Mirai)", "value": "8983d1fd5005fd8a75a2fe1e634ac8b19299a2889c33cd8dd4a4ce6e861dff050958438cbf1e9194e9c7c88281ccb835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976162, "uuid": "eae893f1-6ec6-4d0a-90cb-54904657c432", "value": "T15E631B95F8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976162, "uuid": "01dcbc58-146c-492b-8564-94d0cf2c6bf8", "value": "1536:hgnAkIP7B9stYVenVQm/ct8URqOSQHMgimu2aa7LLJa10ft:ZP19st6en6m/cEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776976162, "uuid": "dc58d44c-8317-4afa-867c-c6871a924377", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776976162, "uuid": "17a27849-e480-4e96-88a1-fc52b3467375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776976162, "uuid": "66cb86f3-c71d-4155-b800-1f19af2dd915", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d1ffa1-3ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776923087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "f06a4920-e9ec-42f9-8b8e-daaa7da699c5", "comment": "Malware payload (Mirai)", "value": "1245001a8985f3da3f4bbd3fdd493598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "6041ef79-ba9e-4bc3-a0f1-228ff9ec980b", "comment": "Malware payload (Mirai)", "value": "f7de2bbcb784fbcf16f0a91c064b7dd1eb8aed438e3acb36cdb8f4adfaa66bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "eca41f1f-9a51-4bdb-bcaf-62c0bb1eb00e", "comment": "Malware payload (Mirai)", "value": "8610fe7beb35489039a81b963898b37d4ae797ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923087, "uuid": "99456366-a050-4daf-acad-2fc03ce65914", "comment": "Malware payload (Mirai)", "value": "24f575cd1b7861176b3f454e6f27d41e261903b9d37ee68704bb70de7684899a3cbd6215fa93532d22db4e2c481ec668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "30c0f1af-ba78-467c-9d70-7638aae5b7c7", "value": "T1BF73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "74306a8e-738e-443b-8c2d-478436e7415e", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStp:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923087, "uuid": "46462797-6734-4b29-ae9b-a1785a9715e2", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923087, "uuid": "6fde9fd2-ea34-49ee-8670-4606f6d2d462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923087, "uuid": "1e91f969-85c9-4f27-8ece-f3e643b3e76f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0706d13d-3f09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776944343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944343, "uuid": "72f65834-1e70-4f8b-906c-aaf3945d6ca7", "comment": "Malware payload", "value": "ae4f82f9733e0f71bb2a566a74eb055c", "object_relation": "md5", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944343, "uuid": "2fbf1dbf-f918-45a5-b432-f68121d4862c", "comment": "Malware payload", "value": "f8dc5e9747ca7ea00c88817472d273c570fec6899134f419cd1ae98235db1830", "object_relation": "sha256", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944343, "uuid": "f67b057c-4d42-4228-af2d-08cecdf19bca", "comment": "Malware payload", "value": "2143541ffe1c7e3c7d795bab37ce0588ed8242d4", "object_relation": "sha1", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776944343, "uuid": "581461ac-8529-425a-aad8-eee32b481e61", "comment": "Malware payload", "value": "e72916945cd9666aba3df088c42c48e20433d434840425ffa138595ab6701b7aa77a00a8fd37fd44a940cf9d3a5ac7fc", "object_relation": "sha3-384", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944343, "uuid": "98ab6dce-1be8-41cc-8464-364f44882e3d", "value": "T1808633C042E4BBE363632EF0C76CF710A0CF925E4BA11904F06EDD46A5679F81776A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944343, "uuid": "158db4d2-2bbb-410d-acc4-b76f82435709", "value": "196608:yxoDK6nZQ22JR5H7dv75CJ6D7tplfAyzr+6xl:ygK6Zd2NhFCJ6H36y5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776944343, "uuid": "fce0544e-034f-4381-8f79-af4b4ddb2c95", "value": 7939283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776944343, "uuid": "412b8565-6c51-4e25-8ece-7206f2fa473f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776944343, "uuid": "7ffcd121-0768-49a1-bde6-5e55ed203f9e", "value": "f8dc5e9747ca7ea00c88817472d273c570fec6899134f419cd1ae98235db1830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9e8573-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955843, "uuid": "3f75d33d-427e-48ad-9c04-b898bd490bb7", "comment": "Malware payload", "value": "08ffabdc6efad9cf8047149f188be586", "object_relation": "md5", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955843, "uuid": "6f2fef4b-ad15-4e71-9cdb-5cc40c05c85c", "comment": "Malware payload", "value": "f9830820262a2061c667713280ba6fa273eafb151cbf05a2fe5c52c15e477101", "object_relation": "sha256", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955843, "uuid": "238e46eb-c889-428e-8ec2-aaaca72edc4b", "comment": "Malware payload", "value": "ae63f2ec5bdfb1e83ed66db59d97c2e2ee50d544", "object_relation": "sha1", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955843, "uuid": "5eff4928-ea32-4e68-bd8d-7e5a2933a610", "comment": "Malware payload", "value": "ffe3d0fd1f7b852af62b0ab9fba3295dc455c88c24ba78e514a4a818b36de643fa4927a8f6ff194ca0384c140f5e14a6", "object_relation": "sha3-384", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955843, "uuid": "04205fc4-5456-41fc-825b-a1b0ba2a0f26", "value": "T148512D99AB262D30B94C0478E80A612424824F2312AC3E9075DFB5289F1974FE373E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955843, "uuid": "4d2d04a8-a849-47e3-9574-0a029b5d7058", "value": "48:JbaFMt1E3KKwyQ4B53hwNwrmJbYQAsqjm39zFYgAwAY5:Jb8Mt1E6Hy5gbYp9jmNzFfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955843, "uuid": "7c8008f0-d3ac-451f-ac96-1303820dc3bb", "value": 2509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955843, "uuid": "6116c1b1-d5a3-4412-a737-2323ee3fd9ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955843, "uuid": "1a2d1e64-f171-474f-a0b5-83772d01d5f1", "value": "f9830820262a2061c667713280ba6fa273eafb151cbf05a2fe5c52c15e477101.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2193054-3f3a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776965648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965648, "uuid": "2da0c636-37bd-4ce7-a14b-21d9cb7b2c3a", "comment": "Malware payload (RemcosRAT)", "value": "75eff53d07af4c17e13d4abc9c075694", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965648, "uuid": "2cbe616f-8d71-4ad9-b3bb-84d0128536c9", "comment": "Malware payload (RemcosRAT)", "value": "f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965648, "uuid": "265a5b5b-2178-41fc-9cb5-efe61b2bde83", "comment": "Malware payload (RemcosRAT)", "value": "be0d7c7680af1a87559ddea664fbbb1c4aa116b3", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776965648, "uuid": "a086bbd8-e7a2-412b-9fb0-5257ceed9c8b", "comment": "Malware payload (RemcosRAT)", "value": "06f35486a1228d39651d83d808a0f534256d2123ab11d431a46b780b16c538006c626eaba90e6329542628514460ae17", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965648, "uuid": "334a3f90-7b9c-4cea-b9c4-99cc18fb6da3", "value": "T169F423C23E005333C9D5127F113D69809AAA6C761A2795A2B65BF31C2A33BF553B39D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965648, "uuid": "bcdc102c-0b26-42ec-9e8e-3b3e6b4df01f", "value": "12288:r6THK6reSAHNMDjysRYPb0VtYIxHNxBvihrSN/FvmBHCTYJTTR0MKn9oz0xXvQaq:r6THK6WtoPub0VtRvf9DGfyZnCQx5fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776965648, "uuid": "2d8f95d2-0cf2-483a-8d0e-c0e887fc99e8", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776965648, "uuid": "29204801-2a43-43ae-aecc-0517f7d2b532", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776965648, "uuid": "a7a7b1dc-1f51-4c9d-ba28-37df67665933", "value": "TelegramFix2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8d66bb-3f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776972380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972380, "uuid": "54ddf853-366b-4591-82b5-4badc48b557e", "comment": "Malware payload (Mirai)", "value": "26cbec4d0d9c363bc257d28ff054473b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972380, "uuid": "339a2b8b-4d96-4ee4-8703-8d2b34fae966", "comment": "Malware payload (Mirai)", "value": "fa0d23c6f3e0707ae37feab80bacf7e45b784daca97c9a2dec243bf85ed1d50b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972380, "uuid": "1e684a45-2fdd-4f33-b29a-84d26eb05270", "comment": "Malware payload (Mirai)", "value": "4121b927ed923816355148eacb43df00335598d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776972380, "uuid": "b777fd9f-a8cf-48f9-9264-f5ca0e5ef015", "comment": "Malware payload (Mirai)", "value": "59b9b8a07e0867e535795e812a15eb9c8710b5a09257b0b619e32dfcab2a98c4c4d7b1b8a534af3cac3bcc05e2892f6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972380, "uuid": "30810a94-11b1-43a5-9113-7d5c0172ab31", "value": "T1AAF30881BCC15F12C6D522BFFB5E428D372657A8D2EE710399225F24378B86B0F36646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972380, "uuid": "6b43f764-1056-4037-a85a-9cd3b9d0c919", "value": "3072:2cserLkEDjH9ku0F44+lgGHA3kbvr/aLs:2cJ4+9kuG44+uGHA6vbaLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776972380, "uuid": "a5789243-c0bc-4183-8899-f42c2083a0ce", "value": 158304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776972380, "uuid": "2e55e825-4c8a-493b-ad79-502e79463905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776972380, "uuid": "ae9cb6fa-3979-4f96-8806-39acccd3249d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538f24f-3f23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776955909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955909, "uuid": "c78de390-6eba-4592-9165-a5b593a00d6c", "comment": "Malware payload", "value": "8ae1c410eb4b302666cc249dcc9ddffa", "object_relation": "md5", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955909, "uuid": "85808b9e-b1fc-47de-b1da-9f02bff439ae", "comment": "Malware payload", "value": "fa72d7d9cd67de1f1312a8c200e04ce70fa5a7220b15d194526d45eeee0452c5", "object_relation": "sha256", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955909, "uuid": "5913aa68-b42d-4682-a431-1a4e280f3bac", "comment": "Malware payload", "value": "4bc3a388dc0d279509ac8b4586a9dc8421486ef6", "object_relation": "sha1", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776955909, "uuid": "3f30f2ba-d5c3-4df0-bbb9-a9a570f46ac6", "comment": "Malware payload", "value": "533bbf606c2cc98b17d459e02bbd8122251de1f24b6221fbf54a2011c51f1059412c4009e4a45091cd6dabd8acb28682", "object_relation": "sha3-384", "Tag": [ { "name": "LORIKAZZ", "colour": "#C910D9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955909, "uuid": "6557a114-ac04-4c47-9534-4cf865283a4c", "value": "T1B021AC2D1B993C717FDE04255AD9123E3C201B5122D924E2154E30B4BB0DB9BC6B693B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955909, "uuid": "2d149ed7-9523-48c0-837b-4423ae0fbcdc", "value": "24:gX612BZQhWC4dUcBcBKHWgEvi/H/GQgvtM5rLA3Kg6MhDaDxsaD6Hlex:gK12BZ00dUceKHNfaaiNox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776955909, "uuid": "943e5565-703a-4321-9106-5d2fdc94fbd5", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776955909, "uuid": "0929aaf0-b794-433a-8784-6b7643e04123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776955909, "uuid": "15d0608c-eeb9-4e0b-b78f-e96c02a7118d", "value": "fa72d7d9cd67de1f1312a8c200e04ce70fa5a7220b15d194526d45eeee0452c5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de731493-3ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776923659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923659, "uuid": "b9908ca5-a8bf-4d0b-a293-2cf2ed686e06", "comment": "Malware payload", "value": "05012259f6272a566bea4a2c2f50bbf1", "object_relation": "md5", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923659, "uuid": "681b1960-3188-41ca-9c65-27e80da712d7", "comment": "Malware payload", "value": "fbe828c1702466447f54429a316043f2d63915410a3baee7260aecc8f460639d", "object_relation": "sha256", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923659, "uuid": "68c79946-1578-4d9e-9236-e8aa8d6c07d2", "comment": "Malware payload", "value": "72cc162e5d4e5ed2ab33dae9e403869fd3bf7db6", "object_relation": "sha1", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776923659, "uuid": "572e2753-4dc1-41d9-a1f9-f484dc590eb3", "comment": "Malware payload", "value": "361223d97047cf4a1d43d80c97c525b3b95e86d412f4f4beba3642653a5c10d64db80ba11ffe51706c1a4bdbb8fd0c08", "object_relation": "sha3-384", "Tag": [ { "name": "52-222-136-3", "colour": "#E45D92", "exportable": true, "hide_tag": false }, { "name": "auth-booking-vercel-app", "colour": "#6382E7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htlwub00k-blogspot-com", "colour": "#4C9C13", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923659, "uuid": "c4769095-51ed-46e7-95f3-db624ee69f14", "value": "T1C9F0F9168F7DE9861FEF33C01408685FA84395779733355CE80015611814775D72EABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923659, "uuid": "ed47ce97-d733-4604-89f0-6c805181c536", "value": "12:snXjkCR8HUZjlftEvkLjlfVL2iOCJkQTkO6hIXNjpURVyyyyyyyyyyyuaoPkLpCV:iBZhftEEhftDOCJEaURVyyyyyyyyyyy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776923659, "uuid": "98b3fbc6-a1d1-4797-8c44-f3f84c4a75ae", "value": 619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776923659, "uuid": "6a0de1dc-faef-4fc4-b002-9ce7e20a24f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776923659, "uuid": "6cb879fc-2601-480e-a207-6375e7f6b50d", "value": "xwormps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cebfe6-3f36-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776963728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963728, "uuid": "9d7eebac-c8d7-4f6d-b9cc-dff9cc23dbad", "comment": "Malware payload (Amadey)", "value": "a85bd5da9a800b3f8e48965a9b4a1b88", "object_relation": "md5", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963728, "uuid": "3d99a866-2e0d-44c2-995e-ec11d9a240dc", "comment": "Malware payload (Amadey)", "value": "fc0622894170e86a3b783e6a97120d9fe519638347de8d8c64ae841fe29d8689", "object_relation": "sha256", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963728, "uuid": "ec817a2b-19d2-46e7-8435-a33142f84c49", "comment": "Malware payload (Amadey)", "value": "81f3f59a6eb43bacda80416dc1aa3ae0b144232b", "object_relation": "sha1", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776963728, "uuid": "03de4816-e4b8-45a3-908d-e6db2d329cbf", "comment": "Malware payload (Amadey)", "value": "46bda3af4c4fbf452fb580c4e4ceea79d0f283595c140f086574ad1e37c9ce403f3ea3c88921869f8b2bf359a9216aad", "object_relation": "sha3-384", "Tag": [ { "name": "135e7b", "colour": "#59338E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963728, "uuid": "3a1f69b5-8dbe-40ab-a1d6-fe701882f3d0", "value": "T1AA359D16B941C071D49401706269BBF2593CAA35672145DBFBD02EF2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963728, "uuid": "a568c702-3cd7-48e0-8d95-c996718727e6", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963728, "uuid": "6595fb61-e020-4b39-80dd-93723d6f2665", "value": "24576:HLCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZUp1:H+ruaRnC0iwzFgI4oJZ41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776963728, "uuid": "0f9c0f9f-2f41-4ff9-b808-28c8c8babcd4", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776963728, "uuid": "93254a73-e791-4f3e-aeb8-3e474b777586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776963728, "uuid": "7cf5db88-b6e4-4dc5-8248-d1b5cbcc19d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02878cb6-3eeb-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776931450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931450, "uuid": "bd76a1aa-b097-45d0-958b-8c9d1e598779", "comment": "Malware payload (DonutLoader)", "value": "3663d7fca30a1727054fd194eb21776c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931450, "uuid": "a3453060-2f82-437e-8fc6-d23b8d0414a5", "comment": "Malware payload (DonutLoader)", "value": "fd2fc7fdfa8c9333e38532d18643879cc0617cf23b3c60bad5269e7dd37935e0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931450, "uuid": "90ff9edf-5dba-4f68-ac59-431fe4a5f361", "comment": "Malware payload (DonutLoader)", "value": "2f779483b258893d05fba558f49628b02540964f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776931450, "uuid": "c3015684-d6ee-4820-9c76-d662eddb8df5", "comment": "Malware payload (DonutLoader)", "value": "b247d155d4578665024f3aa06dca55ce466cb77fb9452f738e6545c0b71de64c5472f3b6fad9b4f4837272fb48f7c66b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931450, "uuid": "2f087a46-4f6d-48e5-8685-06e0543cd483", "value": "T1E1B4021659C81FBDCF584A2C90BD2A0E67B08A4B5017764AEF23BD867FBB944131F1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931450, "uuid": "54e3089c-37cb-4244-a189-db378828bff3", "value": "12288:WHbUQOR2Tua3g6idurJ8LM0vRWLmql+h0C:MgRe3QqR0vM6qW0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776931450, "uuid": "86c96735-c16b-43c0-be08-a4fa929ae67e", "value": 503428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776931450, "uuid": "99a6622c-231b-49fe-81a4-514a0e99404d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776931450, "uuid": "9a9d6f9e-43dc-4f1d-babe-a26730243dc7", "value": "Vessel_Informations.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f788aa-3eef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776933439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933439, "uuid": "a181ae3c-af9c-495a-b621-b238b660cc91", "comment": "Malware payload", "value": "efa75455f6350e6162c2bd15ead94d1d", "object_relation": "md5", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "nexus-agent", "colour": "#4F8F51", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933439, "uuid": "2148e8f6-2de7-4573-9ca4-2d5676d3ef42", "comment": "Malware payload", "value": "fd6193dd2b8171f2c3420d401b011befc954435ed1c5be385297f784070f7451", "object_relation": "sha256", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "nexus-agent", "colour": "#4F8F51", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933439, "uuid": "d76b8620-821f-4c13-a9a7-d7a487994f56", "comment": "Malware payload", "value": "cd0be4710e3d934c76e30f8e26fb84fe000d9aa0", "object_relation": "sha1", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "nexus-agent", "colour": "#4F8F51", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776933439, "uuid": "7f668960-1067-4703-a5a6-253746486afd", "comment": "Malware payload", "value": "55ed4fa3036371d72451515e1e4b191d01a5404e3249d30623ad126db2cd348d29e2171b0ca9096d14378a88245629db", "object_relation": "sha3-384", "Tag": [ { "name": "76-13-82-226", "colour": "#193E55", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mnks-digital", "colour": "#6E2AA5", "exportable": true, "hide_tag": false }, { "name": "nexus-agent", "colour": "#4F8F51", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933439, "uuid": "4f50bccb-0761-402f-9c3d-e0b28f8b7566", "value": "T183319681C958D511C87CA775A856F356FE6382760FB4669F8419BC18594B2CA9F04206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933439, "uuid": "4cf69e1c-a6c0-4f5e-ab56-e3e27c682198", "value": "24:90/BUFL6mib6a6xq+0sNhABa6Ijz7ZTZcLIEz9BabXfw6GZsTRbP/woa/FUFL6sk:90Bo+F6Yqhjz1EN9BaLfCZcbPooyFodk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776933439, "uuid": "df0627df-a1f3-45b8-956d-94d1d293a6a1", "value": 1498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776933439, "uuid": "42a5a27d-31b3-4bd4-b628-391b1a981227", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776933439, "uuid": "e1df373e-9536-45cc-a1fa-c29b90e1abea", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1daa48-3efa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776938175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938175, "uuid": "45d4b8e8-bde3-44f5-993d-135d7bd6cd45", "comment": "Malware payload", "value": "0ab3ab613fd3a85a06ea769b0f4ffa5c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938175, "uuid": "2f688f27-9c64-4c11-af94-4439ec83cd9d", "comment": "Malware payload", "value": "fe17e2ea4012d07d90ecb7793c1b0593a6138d25a9393192263e751660ec3cd0", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938175, "uuid": "9fb1aa40-9d6f-4078-85fa-d8389976a9d8", "comment": "Malware payload", "value": "7d4e9ae49976bc4b65166f2c822d274118b7e5e8", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776938175, "uuid": "a73a03a3-9d2c-4929-9650-f7b64ffa366b", "comment": "Malware payload", "value": "9b38512fde42a02a0a8633edafe94e1ef8c8c80fe5fe76ade50c6f710babebff4dcfeaeedfe1f01a365304885040992c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "whereisitat-lucyatemysuperbox-space", "colour": "#4EACC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938175, "uuid": "8d19aa82-8e83-4844-b4b8-40b65fe3b550", "value": "T1613219C53C2B5A10AA7E4B3FF9CAEC18D005B2575473D99AB6BC06CC0FBD209C5312A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938175, "uuid": "7cd8a1f7-783d-4c0c-84b8-5743b7a82a28", "value": "192:HaPqxW4BBf3YGAUQ3ccVwuvWhXoOn7H/kVBk3aB5w5Olj8vNJ/z:HESHf3dJcVwuvWh4O7feBk3aB5wsjQJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776938175, "uuid": "2f38de27-2364-4b5f-866f-b0c26a538393", "value": 11298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776938175, "uuid": "7a65c542-8b04-4a80-8714-80593310faab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776938175, "uuid": "9b4d0969-0148-489b-bfe7-9c9686697deb", "value": "fe17e2ea4012d07d90ecb7793c1b0593a6138d25a9393192263e751660ec3cd0.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c686e803-3ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776935215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935215, "uuid": "5f689801-90a2-4138-9b4e-9226ec36c034", "comment": "Malware payload", "value": "2a36e01516929b5e2c43ed3f7bb137cd", "object_relation": "md5", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935215, "uuid": "9c0d43ce-b9a6-4292-bf66-b3827d3f2d57", "comment": "Malware payload", "value": "ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c", "object_relation": "sha256", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935215, "uuid": "3503997e-8028-40bc-aa2a-881dacf23763", "comment": "Malware payload", "value": "a05aedfc0906ea392cd182cc75163cba0646d419", "object_relation": "sha1", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776935215, "uuid": "e12965ab-3f80-4f0a-8018-9ab4dfe7ff65", "comment": "Malware payload", "value": "dfe5cebfb126929b03367afc39e4ad3eab7848fb8028a25ac9c4c8869730d4f745d2b665e50af263498f57d93c32afc7", "object_relation": "sha3-384", "Tag": [ { "name": "Google-Gemini", "colour": "#106492", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935215, "uuid": "96539a35-4aac-4541-8cba-5edcff305e15", "value": "T133C47D207E022EFF5BB860C248DA851C5A3C26B5C9682CF569CF5C92391D77627B7DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935215, "uuid": "f0aa3513-fba1-4832-91df-fd8cc9e70a8a", "value": "6144:pTtuPDsBFm3GaN8SGZMXSFei7fOXe0OrXOwqVfv1j73pZz:pQfImIvTOXe0OSwqVfvVNZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776935215, "uuid": "406f92b5-0059-487e-82e6-62d2cd59c677", "value": 569741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776935215, "uuid": "caad8ea9-c14e-4428-aadc-8c754daafd40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776935215, "uuid": "d6e40903-bb5f-4039-923f-1bb4ceb065c5", "value": "ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d79f3f-3eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776924416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924416, "uuid": "d56f6708-1cc5-497d-a5b0-e7a4c55ec034", "comment": "Malware payload (Mirai)", "value": "6ddfd761fe5515aaef60afaf5d86ade8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924416, "uuid": "6b270928-c843-4dad-b9a2-163f98efb093", "comment": "Malware payload (Mirai)", "value": "ff9400d6f811efde411f7491cf415e385c11575e3f525df086578378c1366dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924416, "uuid": "f4b4d2ba-d925-4a8c-9a34-3c7166047d50", "comment": "Malware payload (Mirai)", "value": "db1477f9c476c792d3370b053e14e1b4188de91a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776924416, "uuid": "c208a931-b335-4c58-bc7e-a20a38f5aed0", "comment": "Malware payload (Mirai)", "value": "90af41fabcfaeb87d0c5afc4389b8ff998d1ba65ba4135be77053766a40bf158790f671ac27574ec33128a2c2eff2692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924416, "uuid": "9227121f-c0c6-4f41-9a94-58ed231eea75", "value": "T121C3AE97B74B6590C86242F40BCB5F9D2E3321128F6F98EB2C1E667B197D0CB4D16392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924416, "uuid": "eed30a77-3293-4393-a06c-d7575b7eb5c3", "value": "1536:cAxG1ArEVSeMy8gtXdykTWPobwhNvPOg/lkhqHXmX/LWq:c0G2rnjgtXdykTaq4vPOg/JHXmXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776924416, "uuid": "559dff4d-9fe9-42d5-bb5c-b9a28bcdbbf7", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776924416, "uuid": "16d6b18e-c94e-473f-84b0-bc0afddf654e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776924416, "uuid": "9deb631f-f5e4-4817-930c-a998b604af00", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }