{ "Event": { "published": true, "date": "2025-10-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-10-22", "timestamp": 1761177781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "84d158a5-6d35-4481-b286-c166ad0d9c8b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50424886-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137697, "uuid": "2e7335e6-3f0f-4a98-a01c-4bf5fd07dbfc", "comment": "Malware payload", "value": "6a397ac131d526adcc5ed2493c60726a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137697, "uuid": "47833b48-4d76-4d38-ad99-a627cf5a1c6a", "comment": "Malware payload", "value": "005932f50d5b6e65531774317c6c25ae58ba96f38deffa205cd145d3d48c6cee", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137697, "uuid": "92d88580-b6c8-452a-9c9e-e7fed142c312", "comment": "Malware payload", "value": "5f48da82c9eccf28ea00b774dd12acad4179c9b2", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137697, "uuid": "9b6a9513-32e7-42ab-960f-72d8c601279d", "comment": "Malware payload", "value": "d7cf0c0f2f2a655c6ca762da26c6f04d362813d2479ede7b22fc96e097dc97b545969582a4e7d806c6bdf1b97fe052f9", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137697, "uuid": "473b8739-5060-4242-bf63-05be69510a4a", "value": "T19A665B83E89554E5D0EEE63489629172BE227C486F3123D72F90F3682F77BD49A78710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137697, "uuid": "dfa3742f-0d61-4e8b-aa92-545c114747fb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137697, "uuid": "243e29d2-b316-469b-a34f-75b3ee19daa1", "value": "49152:WQs1tGCxuWvNVrmb5gari961PXZnTDE+gc3oRsfp3G65TBXV4b97JwKeK9KpCGHt:Wtudgf0xU1c4Rko+CcEJ8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137697, "uuid": "ca6e08c4-0421-404d-83de-d8206d8785d2", "value": 6735256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137697, "uuid": "4a8740f7-37ca-4dad-be25-d89a2f8888ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137697, "uuid": "e1dbbcdb-d2f5-42d5-9090-e025522804d0", "value": "S5P.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cce39a4-af55-11f0-91c6-42010a9c0006", "comment": "Malware payload (Koadic)", "timestamp": 1761144107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144107, "uuid": "c72cf921-5e3c-44ae-a755-9e9dca3a6d01", "comment": "Malware payload (Koadic)", "value": "ccff3fed934e5dd4bce7a4559129b425", "object_relation": "md5", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144107, "uuid": "98f1b1da-a0fc-4240-ba06-2a6306a101a0", "comment": "Malware payload (Koadic)", "value": "01d326b461c483f47bd325f847c64bbe1dccbdbb3392a12e4f0422ab4eb7f330", "object_relation": "sha256", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144107, "uuid": "0ec4e8f9-ea31-469f-9c30-ee6025e8e389", "comment": "Malware payload (Koadic)", "value": "56c2d219cb21febd4a60c57db8e277a374825264", "object_relation": "sha1", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144107, "uuid": "8be5fd5f-251f-4d10-8bf8-4e0f971f4b5e", "comment": "Malware payload (Koadic)", "value": "820d3f7cef5440f9e2fb4690617e5e9f629f09ce62fce180964dbc01faf2d39cb5fd611bb149ab5cfdd8758a31591193", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144107, "uuid": "f8dc32d2-0870-4332-b582-2dbea87b3937", "value": "T1D9B1C2AA1A6F72D7F6081D383CFE34897D4E5A3FBA7C400808A9758F1DA64BDE42D501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144107, "uuid": "4d07f34a-d9d8-4156-be80-170dfba9c391", "value": "48:cSQgbyFlGKjfsSS5/JwoiEHIfaS5/Jwh+Ez:Iao0TOOEw+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144107, "uuid": "56f04704-072f-4860-b98d-0c8be4319616", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144107, "uuid": "0310e022-13f0-4360-aff2-6ea1d288b736", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144107, "uuid": "9ac7c748-05c1-419e-96c0-91cb8b1db87d", "value": "BperXBanca_CopiaXdiXPagamento.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9ee9d1-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150469, "uuid": "b45a4e8f-4fcc-4848-ba45-622c69016517", "comment": "Malware payload (Rhadamanthys)", "value": "43487468df6679825067da1e3758132a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150469, "uuid": "3a808859-abf9-483f-ab30-ee4d34f4a8ef", "comment": "Malware payload (Rhadamanthys)", "value": "022c603522279ba7cfe82816d0b28bd17affe745e4c8240033f56b8e10a92b34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150469, "uuid": "ea8460c7-954a-46b2-85a8-89ec64e032ff", "comment": "Malware payload (Rhadamanthys)", "value": "131576fc6ddba0f054a6c66a55341b9590e4facf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150469, "uuid": "6db1a571-0d1f-4f49-afae-df50e6151f3b", "comment": "Malware payload (Rhadamanthys)", "value": "627dfad4dcc7e441399e8f31883fb3ea7b1a317c4c418d14c3e7c25f306e5ededc61ba13df90d36ace09387503f4513f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150469, "uuid": "b7ab55dc-80fc-41c0-b290-e41cd9da2017", "value": "T14AA3099DACBBDCD57313B3917E6EA0EB7E454B28D91F128D002A472B8E4DD141F29983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150469, "uuid": "da4c95de-33ca-44c7-8a52-04a7d17965e5", "value": "768:GDhd0i7J4sYKgY/CMNfWdz0LfLarX6qrGoikHybArx2USLAuAAroQW+FF+Ec+0FY:GDB7eKg20nrrrGoiDbAr4U6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150469, "uuid": "68e26428-dc2e-402a-8730-b0886c400867", "value": 107358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150469, "uuid": "b4dfa2bd-1888-432d-aea6-f35be9700a7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150469, "uuid": "348b0280-9be3-4838-a6c2-0256a10ce39d", "value": "invoice-1637482117.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815ac06c-af35-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130478, "uuid": "960c6336-f8cf-4bdd-ae49-70b458adac6f", "comment": "Malware payload (Mirai)", "value": "e3fb7bdb9ecd644d633b19b401177464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130478, "uuid": "e2c6b2cc-f19c-45db-81f2-8c2eb3c9d333", "comment": "Malware payload (Mirai)", "value": "02558bcef99120a8337d03ff3b8f34d67d8dcefc8802f6f210920a4be5771c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130478, "uuid": "069f85c3-125c-46af-be23-27ddc540b938", "comment": "Malware payload (Mirai)", "value": "2bea809d24a51e40e64bcfafd2a7a21544b4b5f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130478, "uuid": "964069c0-ad01-49a4-82e2-19b9be7231f7", "comment": "Malware payload (Mirai)", "value": "17facd279bf9d45e2fe941240bd06a9fb80af37ae97e183792d8af8fbcc71d53e8912f8e34bbe3a51195b7fbb4165459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130478, "uuid": "7e95eecd-9154-47cc-ab52-031975459453", "value": "T18B042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130478, "uuid": "bd0afb06-7fe0-4ad9-8087-780c361ca93d", "value": "3072:ObeqvR6sAoYj3ueaac+TORe3fsr4FlLJRJ38YhTfYo+M/RzOVdcLn:OeqvRIoY77aac+TORevsWLJRJ38+x+Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130478, "uuid": "e5e40740-0915-4eda-b8cc-2b3fe0b9e8d5", "value": 181458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130478, "uuid": "82a6c5f7-d96f-489e-9fb6-7873e985fd95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130478, "uuid": "fb74185d-34de-459b-8fd3-6f3c87872337", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f47bf4-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112739, "uuid": "8819354a-1f97-43b5-8168-ff70705b1dce", "comment": "Malware payload", "value": "6e17bd681609434cdeda9fb21992bf8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112739, "uuid": "8de72bb5-4389-401d-8245-390006d375c8", "comment": "Malware payload", "value": "03df28c85e846db60a9f51637fa11d75fe8912d9bf99f4c14ffe362363d48025", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112739, "uuid": "e851124e-5482-426b-8790-b4c68e7d1084", "comment": "Malware payload", "value": "88776936453c21278f8ff8c987f6a5987d667df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112739, "uuid": "f661d11f-16fd-4755-8e48-fd0485e23baa", "comment": "Malware payload", "value": "8913c2278120f763f2ac18018fd7afe02e3f3ace7d772cee4752d5bdd46f9b8cb92b09dcf522b3eb6e50b06cd27790f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112739, "uuid": "6771ff76-2275-4dcd-91d2-cd497771ab6f", "value": "T14D463947ECA555E8C0AED63086669253BA717C494F3063D33B60F7782F76BD0AAB9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112739, "uuid": "86a102e6-6bf2-43ae-b881-303182ca6c83", "value": "49152:0BiXb9hDWF4wAinLyjUHvodBFKZ6aPPxvk5EHYuzxPDGP/2xt7Td4KgKCtyofADD:VDUjxKI5+EVoKmFoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112739, "uuid": "dcd75187-2561-4cdc-9eea-b6f3e9e69404", "value": 5812376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112739, "uuid": "e057f456-28df-4633-bf4c-7302ddd50ab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112739, "uuid": "73ed38be-9ef2-457f-ab1e-aa2a369593f2", "value": "system", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828eba7d-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150667, "uuid": "dfe90efe-bd12-4a19-9dd6-0ea9d7cdff00", "comment": "Malware payload (Rhadamanthys)", "value": "ea346a3742accda98d7e0543effe2146", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150667, "uuid": "efc58fc0-99f2-405d-bd21-01d38bc367a6", "comment": "Malware payload (Rhadamanthys)", "value": "040b1cc9067cef6bf098b4d6891f9d6fc0e9124cff6d7b9ac9e4e16e39e023a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150667, "uuid": "ead39558-4091-498e-8861-8435a46834d3", "comment": "Malware payload (Rhadamanthys)", "value": "9698a73ec82e96b2feb706e8519085065a59ea9d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150667, "uuid": "d0ed439b-d2f7-4952-ae84-406a12a4436b", "comment": "Malware payload (Rhadamanthys)", "value": "fdd553165fa8464527d7a75537cdf04e5d7ae35bc83d59e55d9567f498f04f95a58e5bfa7c02aa13d3d12b5f495a736a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150667, "uuid": "33de569a-3a68-4c12-871f-fa8c8b8c32b8", "value": "T11CA33A20EEB6EAB225364B2B94C67AFCD91C5405A87D046E952EF782F95023D4D3F4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150667, "uuid": "fb90ae22-4113-4d11-8339-56fe9d77bdb9", "value": "768:GDhd0i7J4sYKgY/CMNfWdkDFrX4CrK4ccHqADIAD5wnjSLAuAAroQW+FF+Ec+0FY:GDB7eKg20ar7rK4cRTAD+j6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150667, "uuid": "d39f7e03-08bd-4317-9893-091847e4d6a6", "value": 103379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150667, "uuid": "4ef42221-6c02-45ea-86ed-1b981299c055", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150667, "uuid": "80242aca-48df-4de3-82ac-d2afebfd9ac3", "value": "invoice-1637482117.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2decba3f-af39-11f0-91c6-42010a9c0006", "comment": "Malware payload (SSHdKit)", "timestamp": 1761132056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132056, "uuid": "53488bb8-dee5-4dca-8611-9ccf71165b75", "comment": "Malware payload (SSHdKit)", "value": "b40f0b6f9fb0831db8bfb693320d883b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132056, "uuid": "47b4fab2-8a3e-4d9e-b4a9-fc4f7b959173", "comment": "Malware payload (SSHdKit)", "value": "04b58e97c702e010b25cde58c32e14e9bf05ca1241d204579fafadd5375ce5af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132056, "uuid": "6b7d969d-f4e3-4241-8769-a1cee3846133", "comment": "Malware payload (SSHdKit)", "value": "e48a695c98f8c7078e485ff7657c113a6fd263bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132056, "uuid": "a8bc732a-6143-4d56-95d5-916e540b44fb", "comment": "Malware payload (SSHdKit)", "value": "e93e8e92568fdcfd23cfa9db5dd3727f12dcc5167c118a47edab83f151e9c4b2e267466b378a1d41c49c1bfee7bff61c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132056, "uuid": "c680d8f4-af58-4671-992b-cd582d61583e", "value": "T1ECF4E1C4F6E41E67D447813F978246770166ED1FB34AC31B678866BBB4AEA34EB14380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132056, "uuid": "9e38e2f5-3313-4f5e-91bb-ec2c3d170251", "value": "12288:lZpdDbfRWxSYOkwVcqcMFT5G1z6EtYOyDIGOnd7p:lHlb/KwiqcMFUzYP8GU7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761132056, "uuid": "c4f57f88-143c-4da5-be75-1ffeba69ff74", "value": 787917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761132056, "uuid": "2046d4f3-f689-4d05-b3e4-89f077ee650c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132056, "uuid": "84af90fd-376f-40e6-a071-e184ad82aac2", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f15839-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150642, "uuid": "8e1a6d22-8822-4948-b72a-7b168c6d76db", "comment": "Malware payload (Rhadamanthys)", "value": "feccd9e85362044a99aff993c48e3ae7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150642, "uuid": "23240281-6446-40a6-9ee9-90bdaa1f73dd", "comment": "Malware payload (Rhadamanthys)", "value": "05b367cce745a9efb0f592d82c81ef2e2c87aa9a9dc34235f0564da23cb124fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150642, "uuid": "004c0217-c080-4066-bd88-1e8b341351ba", "comment": "Malware payload (Rhadamanthys)", "value": "585d13410e2bb99d279a0ad8cebc31635f12ac91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150642, "uuid": "7c44e10e-a106-4d5f-89fb-e3a6b25f5c6e", "comment": "Malware payload (Rhadamanthys)", "value": "543e6f8b6280d38b0c5aff01ffc2508a89ab77f6101c0619f7b1013a7b2f25ad76af7d497691cfcfde91ce0e08f18818", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150642, "uuid": "102b9f2a-c081-483e-9085-68983be4fbe2", "value": "T132A3F861078A74F1688EACE16E1E7FB7E11EF41221151B08D12FF6A1D43BE9BA4781D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150642, "uuid": "78edf966-2ecf-42ed-996d-33cd949ea96e", "value": "768:GDhd0i7J4sYKgY/CMNfWdgiZiRi8iyiTieiLMiDi8iwi9itiai4idMivi8iyibi0:GDB7eKg20QVrsrmj0s8Apnm6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150642, "uuid": "00e8d74d-a7b3-4395-8dae-83d29cac7acd", "value": 103420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150642, "uuid": "2dae5851-b6dd-4b70-8f04-8ab42507aab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150642, "uuid": "e0bb6f9f-42a7-4333-9ada-db2bde90cc59", "value": "invoice-1637482117.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafb900e-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150412, "uuid": "5de9bc5b-f98f-41fd-8774-28af1cad215b", "comment": "Malware payload (Rhadamanthys)", "value": "e7c50f38afb0b7dac58f6caf9ed30643", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150412, "uuid": "348e9fbb-b78a-4403-97b0-150a81eba6f2", "comment": "Malware payload (Rhadamanthys)", "value": "05bc87b780667bd3e48bd8068908907049a46c6e362c7b04fa080e824ce378b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150412, "uuid": "6e87692e-eab0-4103-a712-b175eff7e0b6", "comment": "Malware payload (Rhadamanthys)", "value": "847f15ed2c40888372919067824973f827e1c001", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150412, "uuid": "8dc1fb74-db28-4528-92ef-de03b80f7c26", "comment": "Malware payload (Rhadamanthys)", "value": "752488b357578737dd69ce97ba9f8b83beecfa076a7bb0dcb6770248fbeebb1dbdf55821c353983b7f7f1864da29487c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150412, "uuid": "cff700a9-31b0-4683-b476-1dc7504c6925", "value": "T1C2A3FB509D624CBF227268D7EAE09059410FBDE2890D9159943F3BF1BC69B0ADDEC393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150412, "uuid": "3f7a1653-6291-4f9b-a902-5651324dafaf", "value": "1536:GDB7eKg20pc1rTrm4zjXG1CvhAbQVDkT6BkQWJ+aY:GDB7b0pctv3z7G1CvSQVDkT6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150412, "uuid": "ff4b5cfb-4eaf-4360-b4f5-f7aabab90bd3", "value": 104779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150412, "uuid": "57fc6a48-6e5e-4680-a53e-ce8ad6a05b9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150412, "uuid": "3577e077-34f0-4747-8ef3-c1a2a70f6400", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a676015e-af22-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761122380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122380, "uuid": "bc939fcb-e206-4f94-bc8b-cb8067aef31f", "comment": "Malware payload", "value": "d03c3e993f840481ff589da1c340c9d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122380, "uuid": "19700809-07c1-43f3-9b67-92f1a5dd1a51", "comment": "Malware payload", "value": "06c725604dfdca21a0a70ee02e3d4779b7ac82414a9b5317a1b4770dccbf2c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122380, "uuid": "6af9afd8-3f67-4a16-8f81-f08965769313", "comment": "Malware payload", "value": "16d97ba9247ef7bb60459cd33cf4a95225090756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122380, "uuid": "b9f32ab1-2483-4f51-9532-0a7234c33d43", "comment": "Malware payload", "value": "9076a099978c836b54af9c016112a442d3d72b4282936bc4224555901311508ae838d55d61dedc9dc04da318655a6040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122380, "uuid": "059e8b65-f91d-462d-a37b-248623fd9b57", "value": "T11C45235E9F5ACD02C9E57B740A60E3B521981D0CCC75E2138BFC3CEB767BB66244A291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122380, "uuid": "aa76fc42-40d8-4ce5-a752-6cd12b3d7616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122380, "uuid": "93640218-0902-442d-bbff-b8ea1502aa64", "value": "24576:60Gad3c7KbOP4uR9m27J2B6EULk3qIL9u2oydeaSDV6Y:60Gm3c7KbOPJ57JQ7ULkMydFSx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761122380, "uuid": "1f92bf68-f079-4389-bc5c-6a23461bacca", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761122380, "uuid": "6435e69c-2d08-41a8-b1b9-9806df165347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122380, "uuid": "746a7dd8-30e6-4258-9914-4a704a90e611", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516787dd-af95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761171629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171629, "uuid": "73a6cc92-cbe7-4ae6-b77b-cd1feb743d83", "comment": "Malware payload", "value": "bccb7a691f9323091a2b5d4b4ef4f736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171629, "uuid": "af3af509-7a72-471d-8165-2407482f036d", "comment": "Malware payload", "value": "0738238ce5f24725197dd54bf3c74621e3b6b1523b7ebcadbee811fa9dc2bce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171629, "uuid": "a3eb29cd-f330-4dd5-8d46-6cd92015ff72", "comment": "Malware payload", "value": "febd6656681e8353ea99a8343da6129034e9419b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171629, "uuid": "f2de1e6e-23b3-40a0-9b1d-a30a546ca38a", "comment": "Malware payload", "value": "fbc14943413f8b98cb2f40aace9fd66f125c209c6182763e7fae127cedb05da0c53887f3b12011c4a3aabbc1844d8eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171629, "uuid": "aa5675ae-22ff-4477-bbf8-c61e49d5d6c4", "value": "T18745D039916262E6F29A807356466180B4B3B87B87355FEF42E0E3361D87BD80F7E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171629, "uuid": "7485ee81-59cc-4b65-8c0a-fd8ce8e4439b", "value": "f71b35c578fe1387c522f88b6d440f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171629, "uuid": "fecf522b-1d85-44f6-968e-3f038a46b296", "value": "12288:J7vl+0ZD4udiuTUSp+BSAVUw0rxM8/0egNpy7lsn70Ou83n9CNLs4gl8SsPtqIrY:BvlLD4udiuvpPiUw0OXls67zsXrtE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171629, "uuid": "1dd823ab-793d-4cb4-b042-0f415d6450ff", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171629, "uuid": "60513791-8918-4a19-8d67-dc080818c94d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171629, "uuid": "e0e9168d-aae3-4232-bd3c-177c000dfdce", "value": "SecuriteInfo.com.Variant.Lazy.697419.22814.14222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5258ed99-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761137271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137271, "uuid": "e64925eb-0e2f-4e6b-bb65-45df24b6f301", "comment": "Malware payload (RemcosRAT)", "value": "0e18b0bba5a0c196fc525f8666eaa246", "object_relation": "md5", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137271, "uuid": "d3a3e2d4-de05-4c6a-8219-2baa06cffee3", "comment": "Malware payload (RemcosRAT)", "value": "0764d8bca072090e53966419e3c34553d1c09fb859aab96e5db90a6634c62dbd", "object_relation": "sha256", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137271, "uuid": "97090df6-bc36-4054-8de2-8a173f80161e", "comment": "Malware payload (RemcosRAT)", "value": "2f5137f99cb969f6944d0e66d2408840d1d54082", "object_relation": "sha1", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137271, "uuid": "01d8efd2-2305-41f8-8fad-280390d08dd2", "comment": "Malware payload (RemcosRAT)", "value": "c19b3d808c55dbb827778f00ca7b295ab65fd1c2b7bc9dc4e46ae10098cf83bdb0aaf0a38e2eab4735deb4974250854b", "object_relation": "sha3-384", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137271, "uuid": "47ca850d-b1eb-4006-96d5-f57ccdcd12b3", "value": "T104614B72777586542E438456EE9F3D22766069F235C2C8FB10C622DA6B25508E019F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137271, "uuid": "3afc0c27-7587-4458-a037-07468b978ca1", "value": "96:ZS9dDREWuB4fCPrViRkipqb0IDbbmXa8krSJokbAE:2dDREWK4w4jsbjDvCDkrF6AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137271, "uuid": "7993386e-1dc3-466a-9030-901edb0f28ac", "value": 3239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137271, "uuid": "4d398ee6-86e9-4751-9667-0115492d35b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137271, "uuid": "4e3e5691-f21e-498b-b3af-e63e8b2c055b", "value": "ORDINE D'ACQUISTO-No4514944459.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4891ebd6-af12-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761115351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115351, "uuid": "6963b50b-63c0-43bc-b0ac-b506e4f0e38c", "comment": "Malware payload (Mirai)", "value": "cef83fce62354fa018e8b40ba7d6c334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115351, "uuid": "ba02a6d3-04a8-421b-b8e1-c6fd2b69868a", "comment": "Malware payload (Mirai)", "value": "085b5e14901c314cf9ad3efac7b1bfa69c21fb450d43d3a47ef1ff9760158d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115351, "uuid": "a40ba406-8714-4fe1-91ab-550883abb7f8", "comment": "Malware payload (Mirai)", "value": "5d7772e41d5f2795211f9ae82944b70f38d6ba62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115351, "uuid": "311355d1-3c4b-4409-b364-58b845cfe678", "comment": "Malware payload (Mirai)", "value": "c7a4004ffc8a66a24544257cb1612907f4ef04c42b349f5c7905d1873577e51802138e06d6249920d8808fa916938330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115351, "uuid": "aa8152af-f4d3-4676-aee1-0e7330534aa7", "value": "T1CAC38CA43E4F7C51E3C7E37DDE484F72711775F4C26192A4BD22432EC4EA8AA8AE0552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115351, "uuid": "19365972-7eaa-497c-a864-b249e7287ff8", "value": "1536:gQp3D6/LmZY3zTsN6Mw3FViADPzE+E0/wmsGBaGEt/s5dM8glcedm:gQpTeKZlz82yPzE+ECw6Y/avgWedm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761115351, "uuid": "ebb96ef4-0f21-4a15-87d2-b5591efcc758", "value": 124760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761115351, "uuid": "4471b4eb-a948-4b6d-a0dd-42423ee71536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115351, "uuid": "88e66e76-d916-4440-ad62-33fd04de196c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccc9f17-af57-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761144939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144939, "uuid": "c1ad6487-41a9-4278-927b-7ac33c5843b0", "comment": "Malware payload (Mirai)", "value": "befa453302e78264c7fd5cdc3a78baff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144939, "uuid": "57f28f2a-b206-48d1-b5a8-0fc0f92216c9", "comment": "Malware payload (Mirai)", "value": "08e45c730781a2112994868217080291d238e83ee25f9488512a07596a780c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144939, "uuid": "2f276010-5ef8-4b4f-81ec-b956b22f8b4c", "comment": "Malware payload (Mirai)", "value": "5ae625a14f7361ff810b2b5e6f75e3880eb06c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144939, "uuid": "d6d136db-5300-4c85-9517-1a9718ab8570", "comment": "Malware payload (Mirai)", "value": "f335df635168b54fcaaab5a2bbcbac551b23c4d1667b0b584a46de9b9079ce0fd0956f12851a69fb4fa6ecc64a262a55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144939, "uuid": "ec864131-cd61-4b3a-af61-a2d8ce40d744", "value": "T150F38C22DC756E98D26481B4F074EFBE6713956041871FBA29ABC7B58883DCCF9053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144939, "uuid": "5bc52cdf-b3d0-4e32-ab45-88506e94be53", "value": "3072:kEJUxCRcxkfh5fQzaYafWcz6eF5WV+vCEv4G:kEq+q4fQzaDgykVAvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144939, "uuid": "3a0bb84b-d10c-45fd-a794-9387fb563491", "value": 163940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144939, "uuid": "a9521717-d749-43bd-8570-2dfca7e43446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144939, "uuid": "01bd2f03-3d61-47bd-b70a-006e657c86e4", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9f2ca8-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761149687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149687, "uuid": "1cfcc5ef-35d6-424c-99a6-27ef32987334", "comment": "Malware payload (Mirai)", "value": "055ee378a110f06e083a21790c0d41b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149687, "uuid": "cd0ca140-8f6c-4a1a-8521-cee8f1bc603e", "comment": "Malware payload (Mirai)", "value": "0926f4590f51b6672b306431e8abebd60eb37a774f51105bb437c0e2b01f9146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149687, "uuid": "abe6b2a2-910c-4101-9095-f12b97a14d9b", "comment": "Malware payload (Mirai)", "value": "b6bf42471fad7f1675ad5bf3bb273cc39b631f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149687, "uuid": "cfcf1fc7-9d81-4b32-b64c-deac301c0d1d", "comment": "Malware payload (Mirai)", "value": "18c57e154f58eeb97da4cf106cd6a7d3d615e1bc26145f0e51857804a25860fdfa4ac3c9b0291d4c2b21653e1d4a1c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149687, "uuid": "b9a78a71-89e6-4173-951c-9f4085f2381b", "value": "T1B034341D2E22DF7EF66C87304BB7C965979822D626E1D549F26CC31C1E2024E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149687, "uuid": "44cb786f-ff3c-4071-8113-c62bfdc4317e", "value": "3072:2O+D7/Fq+36LCOjEhaqAsvIMMDJwwC8u7JQsC9xumK6ePKEw90MsMzHg:2OG36LjEhaYlm/LUPKp0MRzHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149687, "uuid": "08b46304-f074-4834-9210-c4bfe753a64e", "value": 241016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149687, "uuid": "92f7ef55-d143-4008-b9b6-ad6a0abd9fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149687, "uuid": "038b600a-14f5-4449-a78b-bc016cb3cad4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda5c69b-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150444, "uuid": "0e7bb9a1-8793-4f0f-bbad-a96996dfc6e3", "comment": "Malware payload (Rhadamanthys)", "value": "9e0ad82f29443992fe4304104a72eb4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150444, "uuid": "f0a8293b-db95-40ac-bfc3-21a655107a7d", "comment": "Malware payload (Rhadamanthys)", "value": "0a228f4b000922ca112028890e993b971155b89932035d7d6ef239cdf57eff17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150444, "uuid": "972c10a1-3337-45ee-8623-20337270ab09", "comment": "Malware payload (Rhadamanthys)", "value": "89dab48dc2838bb4a0725a4167b4a35e59a9ddba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150444, "uuid": "d96827ab-3d91-4978-8f94-bdcd0510048e", "comment": "Malware payload (Rhadamanthys)", "value": "df84094a9970c3ff3ab79198cc9197b753c8f4ffdb4b01c564fe2ce566775501ec991964ae68001af9fbedc93e756a8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150444, "uuid": "3a4dc29a-5fa3-4239-888c-5470642f54ff", "value": "T1C0A3B79A5DA2FD63254F23C826495CFD882939582049389EC63FBFB1932D5316C907FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150444, "uuid": "1ad37971-7ed3-4c52-90bc-d8d7f4192dc2", "value": "3072:GDB7b0m9zk62iB4uWS1t0KPfnwBfw7swE1/5JC92yrIKPoPX6K2i52y9A2ijEAEq:099zk62iB4uWS1t0KPfnwBfw7swE1/5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150444, "uuid": "dd744440-2ac1-48fd-a234-f29d5ee8b0e0", "value": 104682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150444, "uuid": "9a7ce524-70d9-42d2-a6ab-77b4d026fd06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150444, "uuid": "3689c363-6a50-4ff3-b876-effe8507445b", "value": "invoice-1637482117.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89c2323-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761131081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131081, "uuid": "30779c8b-2726-45fd-aeca-2d11247ee05f", "comment": "Malware payload (Mirai)", "value": "d9a5f3183c8a3c9125ebe969ab4fbcde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131081, "uuid": "fa363b92-1d3c-400e-bcff-c4fda5e5fefc", "comment": "Malware payload (Mirai)", "value": "0a5c3b3c071f7d9cbedf2e83e416c8996f4670ea4880d8c300d7feaf28686938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131081, "uuid": "9ccda003-e23d-4ac4-818f-bb3a428118a8", "comment": "Malware payload (Mirai)", "value": "52c8d0705ff0e248699ac8b0054a472fa3ccbffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131081, "uuid": "0f0e9af4-1bbf-44a2-ac78-5bbc82af3f54", "comment": "Malware payload (Mirai)", "value": "9231ee744de35cbbd400e0f7f148fa3320fdac62e42ab684c2968160ccd65a084fbf5f1391c604eac62db8f147756858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131081, "uuid": "bab9aa04-fd08-40f3-80cc-02829a1d678b", "value": "T1F4937CC4F683C4F2E84305B1507BE7379B32F1B9101AFA43D3A99A72DC91551EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131081, "uuid": "de260ad4-e98c-4077-ba8b-595b6ffa6735", "value": "1536:W/QCZaxGdvts3FVVPhElAxPu++AjloUIKqI4FrS4LSl:WYCZa8dvm3nVPh4AxP5JlKKfUmDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131081, "uuid": "42f54090-e9a6-48da-9e1a-163983965d30", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131081, "uuid": "5e3310b7-1505-4efa-a1df-c2f65aa645a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131081, "uuid": "1e1b8791-0c88-42e0-a52a-4a361c6a1a93", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35041f6a-af98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172870, "uuid": "1e2f986e-f450-44fc-9ec7-0a5073bc5ec6", "comment": "Malware payload (Mirai)", "value": "5fb79ecb26a6485124d2828fadf752ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172870, "uuid": "0270a93d-c4a4-46f4-8524-ad72454f5a05", "comment": "Malware payload (Mirai)", "value": "0ae84f8fe68c0a268a778af10f233f1804c29840bf3807ce9e4753c9a1339318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172870, "uuid": "2cef5824-56a6-4f3e-a4bd-d4105213e7cb", "comment": "Malware payload (Mirai)", "value": "e9f34584decaf12c2d800cc98e42ef57a80870c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172870, "uuid": "dbf88159-ef25-4379-bea9-a23ce3909355", "comment": "Malware payload (Mirai)", "value": "4f1dcbf8d482e7dc3e68f86c565b10214f6b5e092aa02050025eb52be242f365cd34fc1e3b374f504b202410792013b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172870, "uuid": "1c63a070-ddc0-423f-8029-00b54b6163c3", "value": "T180D3BEAB724B1511C86142F05BD38FCE3E6372128E17D9F72D0DA63E28BA1CB59467C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172870, "uuid": "9ca9e0a8-d3af-4523-8e8c-3032f48f99ce", "value": "3072:tbayWj0ukGELjSQ6Q+djlsMQepJovCErgJnHq:laFj0vjSQQsMBwFwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172870, "uuid": "03cb7192-73ae-446c-8fa3-cfee34cf3770", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172870, "uuid": "0af777ed-b8f1-429a-9234-bc21836fa5d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172870, "uuid": "2e4bd23b-181b-4bb2-9127-a0fc314b5844", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55761d47-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137276, "uuid": "8a787ab6-4001-4e3b-b3fd-d5e532e34634", "comment": "Malware payload", "value": "fd7f8928602bb7d906d8197d4330da01", "object_relation": "md5", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137276, "uuid": "539fd8c7-dccd-4a85-9cda-e8677e61a38c", "comment": "Malware payload", "value": "0b3df1b7b218d03bff0e447148a47430906571a3d4addd8f7d7c804aad9f8362", "object_relation": "sha256", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137276, "uuid": "928667d1-dee1-441a-9a2f-e0b43d6f0023", "comment": "Malware payload", "value": "618b37da23259d5c589e9f57b12a4365b67bd48a", "object_relation": "sha1", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137276, "uuid": "a080aefd-7b08-40a8-a24e-e220eeca254d", "comment": "Malware payload", "value": "1cbd9a40d18a9a2634fe2d71550ce5a2f06adb946eb48b8b8d6a0d300e73ec6e07121e8ba7338c500c83a66ef9f0ab41", "object_relation": "sha3-384", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137276, "uuid": "620ecd9c-0866-4176-a237-32bc5c74fe3d", "value": "T10F943697893DDA354BAE51406409FBBF2A24218244BDB67C903A87F9F43CDF124F598E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137276, "uuid": "bed62f94-f934-44a6-ac88-2b1aace0d6fa", "value": "6144:3kMg3G0H1YeiXE0FHn4CSmvpW4uUE/nCmtU9ykQ/W8s911ts+F2x3RBcRYbpG9gs:2Gq10j4Crp5EQS/Wx11ts+s2RYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137276, "uuid": "7c261f21-4155-4a7c-b0cb-eaa36ae7fd25", "value": 433692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137276, "uuid": "13591b57-0e49-44ff-be7f-bea243a4d62d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137276, "uuid": "c5fbf446-83b7-4efe-a4a6-48af8a39ee4f", "value": "3lyygr.afm.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a14df1-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761113485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113485, "uuid": "45641e8b-ac8e-4374-9819-1523b2ea6014", "comment": "Malware payload (XWorm)", "value": "d82abb7a5a281f9dc56ea31d2c544254", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113485, "uuid": "0a31a982-35fb-416f-ae51-a3f03581404e", "comment": "Malware payload (XWorm)", "value": "0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113485, "uuid": "5021b976-90a4-43f7-84d1-e8736facf102", "comment": "Malware payload (XWorm)", "value": "07575f079f3f084151a349526cb39027b8503d04", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113485, "uuid": "039ab71d-6c48-478c-a74e-71201a952a9e", "comment": "Malware payload (XWorm)", "value": "f6d1d2f7cd53c5270c5662a0d62a2e387c2b1fa9e02c780983ed58ce3eb175f1614299a66abd1dbc1039e485a8953291", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113485, "uuid": "44e4293a-bc40-4a1c-a98d-34b3ef5f4620", "value": "T17E32DC50150EE8C51DBB311D8C50CD8FAA18B0DA9F2998AF31D4434F653EA1DC8DF9AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113485, "uuid": "c771f711-6d84-4150-9978-e94c523489e9", "value": "96:RcHyTUu8rqiPOEKNe/xHee5BzBs8EFlfZXWDd:RNUu8eW/fce5s8E6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113485, "uuid": "8eb143f3-1d79-45e1-898d-f519efbc4853", "value": 11011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113485, "uuid": "3046ed14-9680-4a94-ac3c-44f52d95c222", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113485, "uuid": "0f6e1554-9cd0-4bd4-bc1c-db5423695f39", "value": "Angebotsanfrage_87000341280004539_Metallbau_Figge.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6fb465-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112884, "uuid": "d51f49bf-c2ce-499d-a3ef-e7d3a2f0ef78", "comment": "Malware payload", "value": "95d6cca8c7565a68f182e95b3725f8bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112884, "uuid": "87495971-007a-43ee-bf30-c96494a4b482", "comment": "Malware payload", "value": "0cb89b37239f94d214c12419addf49e3143ae71e53fe1934fa5776c8eafd9c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112884, "uuid": "aa1c1561-e9b2-4e60-8f4e-eb614a14de2f", "comment": "Malware payload", "value": "15cf43e98bda7dfd82d77e7958738b4f796084e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112884, "uuid": "719b494e-964c-4e0a-9a79-9624a0961c9f", "comment": "Malware payload", "value": "eb92c1c85485619463cd039279cd8ca64b6feacd805515ab5c6fae34d85b628c86b67890f43f978f6fc6594a000f2983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112884, "uuid": "1e4c7b34-4f9b-4fa9-a209-f765b7833c31", "value": "T1C1176B43F9A140E4C4EED534C5A29263BF717C494B2067D72B60F7282F76BD0AABA714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112884, "uuid": "1163ad7c-b52c-4b42-8c13-050d04af30e9", "value": "98304:4mtKOUSbv3r9TiOQgKBr2psld+priJqf06EVilqujM5ViGYYEmzZ2239C6s3kmMA:dt79TizBr2pslZJg2ZVEm9uM339q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112884, "uuid": "7e6c67c3-1a44-4874-9978-25f6d4aa3f49", "value": 20254872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112884, "uuid": "4afc123a-2a48-46ee-be19-7de662e271d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112884, "uuid": "c20d7878-115c-4740-a45b-588c1cc7aa81", "value": "proxy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d991bac9-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761113446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113446, "uuid": "b1c60132-cb0c-41ad-9c51-3e6a7df3075c", "comment": "Malware payload (AgentTesla)", "value": "33065ab9c10d6fc46b77a8c6005ef673", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113446, "uuid": "016ef6b5-a43d-45aa-bc97-ed423b6cd45d", "comment": "Malware payload (AgentTesla)", "value": "0e3eaf68fc04eb9186a43a52827b229232facc06bdf1c00c40e9ddf47dd7bbf3", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113446, "uuid": "a84d6eeb-16da-4457-b6dc-62b75ea83bce", "comment": "Malware payload (AgentTesla)", "value": "549746edeb82df68265cfdeb2bda9adc127d75a2", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113446, "uuid": "d99c80f2-91fd-440b-bc22-431b938a36a2", "comment": "Malware payload (AgentTesla)", "value": "4bd96b4cd53d8b4da06d9ed3f3e3b253afa3bcf78ddbaba9f1ca2b44c485c2b8b055ec89415681a656d5e8bdf7fa77ae", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113446, "uuid": "08ae6b8a-6e9f-476c-8e15-9ee22aa90846", "value": "T13915BF013BADBD16C1BE3679B7731AC907B8ED0A5092FB4E089451AD1D9FB01BD123A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113446, "uuid": "890a8378-59d9-4515-8dcd-ca90e95c7253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113446, "uuid": "d8a8c538-c102-410a-8447-c010205a7c39", "value": "24576:TIJu4MROxnF0OVrrcI0AilFEvxHPI1ooD:T6MiG8rrcI0AilFEvxHPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113446, "uuid": "523add44-9e58-4caa-90da-7b4d47bc5118", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113446, "uuid": "885a8600-65d6-4fc9-a82b-bfc05c5157cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113446, "uuid": "8ff5b8b6-08c7-4831-ad31-0af5b1c5b4c1", "value": "0e3eaf68fc04eb9186a43a52827b229232facc06bdf1c00c40e9ddf47dd7bbf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab21c81-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135675, "uuid": "20543915-4fec-44d0-afcf-490418033003", "comment": "Malware payload", "value": "418fe7ef4c461917cdf94f1686cfe1ea", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135675, "uuid": "da4ea3f1-5131-4122-aeda-d855889f3fe7", "comment": "Malware payload", "value": "0f88cba6937a7f4aa5c5c1749bb8d8eae6789bc0d003e6b1503b595fa205f25b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135675, "uuid": "0e4f7863-69eb-4725-99eb-09558d3b6d3c", "comment": "Malware payload", "value": "7ffc1fb9849e311b6aa871a521591bcba9d73567", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135675, "uuid": "4af4e5ed-fb69-465b-aa99-1001b716aa04", "comment": "Malware payload", "value": "efc873d186fa334be59afd0676dfdc8190560e5b724734e4d1e238fe46c86f8e85b62292f34d8be5aae0e80a76224794", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135675, "uuid": "8eca187c-056e-4d78-9348-aad7ed44194c", "value": "T109352366FDE7CB52C58668B845C2C584122CEC837BB2D90B6306376D7AB2BE4429351F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135675, "uuid": "129f3a14-471f-4f82-8d6b-a5f5d654944a", "value": "24576:b0wmmIAPNAwnqu75vybmT/63T3QJl6B9wJJWrFGRKBw0lM:b0wmmAwB1vdiD3i69wJJWoKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135675, "uuid": "cdb4566e-0b60-4b74-a06e-4127792ab619", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135675, "uuid": "7255c9e8-2705-43b2-b5e4-4c28772d563a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135675, "uuid": "41be8f82-2d11-483f-b8bb-1dc0a6314689", "value": "New RFQ-004102125.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c214b-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150656, "uuid": "4951a21a-3601-4203-b488-acd9a3845af0", "comment": "Malware payload (Rhadamanthys)", "value": "afddc0768c9107b5a7aa7f76c034acd7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150656, "uuid": "632cd69c-362e-4c32-b260-793d61782ed0", "comment": "Malware payload (Rhadamanthys)", "value": "0fc0e5b17c4caf1f08a59892a3f46cbad87a62bc6a70d29ce55f0db151b7f60e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150656, "uuid": "b2986938-86e4-4c65-bb0b-2b32197c7109", "comment": "Malware payload (Rhadamanthys)", "value": "1a10e91bc8c67db8e62d605eb386c36ac3d94172", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150656, "uuid": "31f20857-6df6-4169-8829-327c0c3bf546", "comment": "Malware payload (Rhadamanthys)", "value": "698f1d2f636493580250e9e2e03381689d107461b6ffbe38511fa5b34ba94da784e1a23ebcde64780328499cbb415ff5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150656, "uuid": "047b1e74-d0b9-40ec-8398-a6de0830812c", "value": "T1FFA329133E299AF4609542B15FA9B0D09037B4285824BBCC500EB7F8C9AF65E6F57DE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150656, "uuid": "f9f1e339-6b85-4761-ac33-3c19317beb45", "value": "1536:GDB7eKg20Sowr3r6XtAoLeKnTA1A5OUM6BkQWJ+aY:GDB7b0Abwt0UM6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150656, "uuid": "bbf525ea-6926-4f0c-902b-4715ee7a6042", "value": 99494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150656, "uuid": "dffa2e56-c2ce-4e81-b809-e34d193d8189", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150656, "uuid": "650d5844-1b3f-42d4-85b6-d15500978f54", "value": "invoice-1637482117.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37e12a4-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130965, "uuid": "dc8ae72a-81b6-4973-be4f-52bd0056b10c", "comment": "Malware payload (Mirai)", "value": "c550f8a07462f5e83d13bfb5ddc0db5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130965, "uuid": "a6afa5e5-ec0a-430b-b832-2dc0fabdba19", "comment": "Malware payload (Mirai)", "value": "1007bcd35f9ad7839c6d802bd595e600831e6b9a51ec6dbaaf127abdc24eefb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130965, "uuid": "bd1b7eb4-69aa-43a1-9476-dc443182699d", "comment": "Malware payload (Mirai)", "value": "3865e8e3ee3c5affbb9cd305c7b930ef76e3f5d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130965, "uuid": "120c748d-d958-4a52-b0d9-648b6bc9de53", "comment": "Malware payload (Mirai)", "value": "cc59c957998b2931ad5b1449048ab48a1eb05822d3287c14df4a422c51d395aa280ade7df993a5d3f05a2608871b3a5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130965, "uuid": "53c49f28-3e90-482e-a817-96bc319d6507", "value": "T1EC338EB5E42A5E90C15602746428DF345F23A6C4E3836EF607A5C3E24457BADBA0EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130965, "uuid": "fdc4c6b8-e67f-4d94-97ee-5e697e99013a", "value": "1536:Nak4Fo5dowX4EupnuTIK5dkCCS0ob+10mg:Nr4mUk0ngIK5dkCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130965, "uuid": "07fcb6c9-dad8-4d33-9f30-622400d5f4b4", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130965, "uuid": "28d14c82-3d05-40a8-b9f1-c3cb8bf8df69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130965, "uuid": "84949af8-266f-4f12-ae5c-ac29dd9ee02a", "value": "botx.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e449b390-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173594, "uuid": "3b4ffc3d-0ecd-4bba-9c64-31540ed027fd", "comment": "Malware payload (Mirai)", "value": "d4c105ff56435bc9ccff9d03b361f880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173594, "uuid": "28057c63-8064-40bf-8e3a-54cfbf8259d6", "comment": "Malware payload (Mirai)", "value": "108ef84fd9ee2d0c5df4ce54df72c98832bfee00b82ff0546342c8ca84783198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173594, "uuid": "5f93a63b-5457-46fe-b490-e341dad0142b", "comment": "Malware payload (Mirai)", "value": "318abad14d73f27f3eb8d11c25356b9063e00ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173594, "uuid": "49dd17b0-21ef-4127-b12d-c7479252f54c", "comment": "Malware payload (Mirai)", "value": "413a465fdeac2e0df54b2faf349716f430a0724a231a5ba5c8ed4f7bb91d4ad73380107100ea3749f42b9ed0ff0c9fe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173594, "uuid": "acce3dce-5df1-4cf6-9ef6-4afdd4d0269c", "value": "T1E1B31986B886EA21C7C2567BFF4F429D3316539CE3DA3203CD285F6436CB55A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173594, "uuid": "b4f7004f-e1ae-45a0-9ab5-224d291a0f76", "value": "3072:2chThPHcxiadgyuYTGOw98HpFNN85UQlJZvIAZTNhF8RQRAKEB+fKnzW:2c9Z8xiadgyuYTGV9iPH85UQ9vHRYYAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173594, "uuid": "0fb462e3-e8d0-4cfb-8ab8-73d41421aa3b", "value": 115892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173594, "uuid": "33b419f4-9f06-427c-85af-da09e00025bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173594, "uuid": "64c4272f-8d9a-4b9a-a760-90dd2ca4fe71", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82d6659-af9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761175211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175211, "uuid": "b81531ca-4bf2-473d-ad0d-ad87fdf136cf", "comment": "Malware payload (XWorm)", "value": "060e4d46610c41dbd5ed0e964396d02e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175211, "uuid": "a2351ad7-4808-4121-a51c-4b2ecf1b0f69", "comment": "Malware payload (XWorm)", "value": "10c824767b88ce4b3402900b9e0f3092026bb6b782337bc11013bbd38e73d0c4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175211, "uuid": "f47b66e3-42e7-441b-985c-dbdf92c26575", "comment": "Malware payload (XWorm)", "value": "60d61700c3bae20b959cc5e3c902a9cfbbde14c2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175211, "uuid": "4c8f7f87-9462-4e87-9822-b35779b78a7f", "comment": "Malware payload (XWorm)", "value": "5df44cec58c09c3bcc0698b384a68a22d53fd97bad664f487b10390d1a5dc4019bbe34d2bb1124e2d9e32ce01f8f124e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175211, "uuid": "e8849e2f-f2bf-445f-8c19-c0d145ef7b66", "value": "T1A8F3822EA5B49BD4065A23DF648726C51C2836CBD9E3C62897F1BBE3581137BB63D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175211, "uuid": "7f2183eb-3663-4107-bf74-86130fdcaf96", "value": "3072:QOVYGuLMIKEcndVo/H+qWoU/mNuMlAUoMGJVxtD9Rd:QOXuwrEcnjvqvpIUotJVfD9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761175211, "uuid": "c809d22b-7cb0-4f5b-ae30-b32e2f88a84c", "value": 166720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761175211, "uuid": "dad4e992-44d9-406a-a608-c7ff4fd1d1b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175211, "uuid": "73d60bd9-4e07-4ab1-bc78-3ca7c30088cc", "value": "Approved Purchase Order PO20250431.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2360d6-af0a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112112, "uuid": "da8b3ad8-4d97-4516-87ba-90a55c0c9647", "comment": "Malware payload", "value": "1975b58ffa1a8a5b5857097b32af0b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112112, "uuid": "303fc1f6-7a1f-4af0-a56b-b68047ae47c7", "comment": "Malware payload", "value": "11eac354d0f0934bf301eaa7bd4d1b365e09471326e7c5a865a4433971ba9538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112112, "uuid": "e2926a35-ad5f-48c5-870f-012a70633efb", "comment": "Malware payload", "value": "5bc0367d6ba72663200dd211da90b6cec52b34ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112112, "uuid": "a2611b48-746f-485b-bf76-18a5db4c59b2", "comment": "Malware payload", "value": "fec6fb8c8206e1c73b946337605b253d15413cd05770bd461860312d13fdfa2c7c2786c6147c0e0f6983b4491af45fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112112, "uuid": "dee318c1-0f64-4a8d-aea4-2a638110caca", "value": "T1BB363807FCA545E9C0EED235C9669252BA71BC484B3023D76B60F7782F72BD4AA79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112112, "uuid": "675b354c-e055-40c9-959c-3c0f6ade7ba7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112112, "uuid": "e3c23f4b-5ec4-4858-b35b-9e09e896901a", "value": "49152:R07k31IFXWJFd6FcQxGkVVltmqyku2cjs5EvZGq2qICIwyd:RFIaAjZEV9Ivxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112112, "uuid": "d8458a60-6e3b-4f78-b48d-95fe46677126", "value": 5322240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112112, "uuid": "1612ba5d-3ac0-469a-ae93-92dbd3721a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112112, "uuid": "282a6cdd-2fd8-46b4-8590-47874f10bc3f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a81cba-af93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170776, "uuid": "8076fc20-82dc-4bac-9930-0f094a7af611", "comment": "Malware payload (Mirai)", "value": "dfa1dffb2ab64bd563b6cdd85db8016e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170776, "uuid": "7577e015-00f0-4775-a0d2-1ac6a6fd1645", "comment": "Malware payload (Mirai)", "value": "1265c6275954387789316d08f8d9e3431df577a609791e3f490f06885685c004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170776, "uuid": "becd1591-1ec6-4773-8404-6dca933318f5", "comment": "Malware payload (Mirai)", "value": "9be5c36aa45c33e2f29b33d44d074424938846cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170776, "uuid": "d0421e02-8516-41f2-bb3f-2861b07ac895", "comment": "Malware payload (Mirai)", "value": "ca6cf8cf44dfef364f4148aabdfdb78cb42b3c7908ca8e301217d9cc7b6576e8723631152211406c41a14083e1d41927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170776, "uuid": "3c7a66d0-e2c0-4be5-bd77-371fffd6a1a0", "value": "T114B34A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170776, "uuid": "9946a019-6a70-47c1-b207-0a88621fd528", "value": "1536:1a97/6/q0AmnClXL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClXZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170776, "uuid": "7e4fadb2-199d-4cb0-8918-94167fdf0faa", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170776, "uuid": "4fa55c3d-2dc8-4084-a426-54f4eccaf75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170776, "uuid": "fe10fa4e-ae7b-44da-a4c5-e686ef0d5de9", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a006ebf8-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761138261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138261, "uuid": "b0a1999e-def2-4af7-8a72-8b417bc5186e", "comment": "Malware payload (Formbook)", "value": "3c09b9334d432cf5fb09f8bffc57e476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138261, "uuid": "436404f7-b9f9-47a1-b577-8da361b14989", "comment": "Malware payload (Formbook)", "value": "13908a30d295509a12dba8fc2124a88148b5fab48c154157e82c0f510490ba85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138261, "uuid": "41c7b441-c67d-4092-80ad-f2a6228df7f2", "comment": "Malware payload (Formbook)", "value": "2d54c10a12322861f64772f804cafed9f793ee7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138261, "uuid": "d8c14a09-a3d1-43fa-94a1-474f7e6ead6a", "comment": "Malware payload (Formbook)", "value": "479e101baa79e62ba1f6906967fd81702dfd7a08f3d97553dd3020623340a520392a621aa92da8b4c92f32a1216f10f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138261, "uuid": "ad88c3f4-985e-4499-a3bf-f8b8eb4fe5ea", "value": "T13FF40258176FDF56D1A657B006A2E37023789E1ED511E3124FFDBCCB702AB262868393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138261, "uuid": "848d6da1-8687-4154-9a1b-68bc074987dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138261, "uuid": "08862463-c85c-463e-8ba1-da570ce1d1ab", "value": "12288:UjaNqM8ZszAduu5rb7vujUxjHQwOXO76Foa+20N843d2IbO+OL5ww173L/rb8Wk:8ZEAduuNb72SQwUOVE5FNww1L7v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138261, "uuid": "cee49fa0-c2b6-4f00-b0f1-5dae7d0685b2", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138261, "uuid": "3cc80336-f279-4039-8723-a07dd7d29ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138261, "uuid": "18102339-b076-4b9f-a633-73ad928958a7", "value": "27396- TEKL\u0130F \u0130STEME FORMU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dc06e2-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150597, "uuid": "a0fac9eb-fe11-4f9f-be68-c18bbf252cc9", "comment": "Malware payload (Rhadamanthys)", "value": "065a97a90b6a22bd81a282fbd39d5256", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150597, "uuid": "55ae4fd3-b600-4bee-86de-28c07d35610e", "comment": "Malware payload (Rhadamanthys)", "value": "14099fdc500f3989065058295134b2fa0457ec845446440605319b6b9a18356f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150597, "uuid": "b0068b0a-3b13-4955-9c54-99ebd1bda4b1", "comment": "Malware payload (Rhadamanthys)", "value": "0e75e6603b3ee2e5f58c30283bfa29b66c0798ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150597, "uuid": "61cbc6e2-29f5-4e50-88f3-4c5b41bf427f", "comment": "Malware payload (Rhadamanthys)", "value": "d555be1133aca3ee9102c2335c056f78bcf61879a760ad27dc718f6a1c74382f64d2ac9f801e9bc25fbbd9fe4e60ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150597, "uuid": "7ca04cef-57fd-4732-830f-1b392b79bcd9", "value": "T156A3EA106BB1F6E549DA0AB65EC77AF2C836D108FB04E5CFEDE9431054E9A14028D7BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150597, "uuid": "3f11cdc2-6abf-4e4a-a6c7-97a61b55de28", "value": "768:GDhd0i7J4sYKgY/CMNfWdMyOVd1A9Y86dXQ86DYhVdtADdRase7Wx6YslxZzLmjb:GDB7eKg20mr+rNz1PBA9ww6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150597, "uuid": "c35096b8-bc15-4f2d-b176-182c68ce9f67", "value": 102113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150597, "uuid": "34e1afc5-f80e-49c1-b8e2-94206a0f6a98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150597, "uuid": "83af4554-e750-47f3-948e-2538209c3263", "value": "invoice-1637482117.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0463e6ca-af96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761171930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171930, "uuid": "c8452ed0-fdac-4565-a7b0-9b846e2e6ed2", "comment": "Malware payload (Mirai)", "value": "8705c6f7f598e4044fbad77ed47f5601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171930, "uuid": "723edf72-fb6c-4492-b604-ef84c561dd38", "comment": "Malware payload (Mirai)", "value": "15c555f6d2014a41eb89f2779f43d1fc11677f501a3219cd3aa72bd0619a2849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171930, "uuid": "6612648a-d637-467f-9a7a-6b59310ccc01", "comment": "Malware payload (Mirai)", "value": "a43872afeacd2755470d5b185d1a53793e39e671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171930, "uuid": "c283e380-74c8-4cc3-b36b-ddfce4df04fa", "comment": "Malware payload (Mirai)", "value": "72766ad9e1d114b74e2103f8638fc59056c6725c610c61ecd27615600842a0e35c96f22e9ba6071183aeb1ea2f7607d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171930, "uuid": "b16d2d5e-eea9-4bf4-97be-df4d1fec2dd6", "value": "T185B2E133CB30BB31C930083BFC39D501DF565B3195BA745A59694B252BC1ACF52BC689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171930, "uuid": "757a8818-9b81-49d7-bdc6-d16e377dca6d", "value": "768:4bOIC33oVXf7LfjsB1oKKwDP4Wcs3Uozr:4beop7LbsBjKCP9zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171930, "uuid": "90402a2c-84df-4fe6-a8fd-e1adef61b7ea", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171930, "uuid": "752bd011-532c-4f82-ba2a-9db2ed0de139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171930, "uuid": "005a057c-56f8-4947-a0c9-60983bf19405", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99454be6-af4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761139967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139967, "uuid": "f55d2be0-be15-45a7-9776-35424f0822e2", "comment": "Malware payload (Mirai)", "value": "32bc6c73131894ada72fbe1b41f4f402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139967, "uuid": "d4d12f9c-148f-4284-9808-2b485156b609", "comment": "Malware payload (Mirai)", "value": "17be4ec1876e46087e0b20b2949aab73785936a050abb9cb1fd2cf89e74b443e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139967, "uuid": "ec3fe303-3bd7-4fb8-a3d6-f906dd8844ae", "comment": "Malware payload (Mirai)", "value": "eed8a5422592f8e58c1fad9139aee63bb3661791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139967, "uuid": "11572bd7-fd54-4160-8f40-afde802ce776", "comment": "Malware payload (Mirai)", "value": "34a26d6fc5dbe9312ec57123281ce1d3a492060b9aa7b39f61e8ade5e7eb835913a6157a520bd8f1388486415e80104d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139967, "uuid": "78448361-a053-4a7b-bd75-d542666f9a5c", "value": "T12A730745FC918A6EC6D027BAEA6E61CE336177E0D3CB3217CD244B25338664F4E26B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139967, "uuid": "f9ab1afe-f62b-4f11-8119-62aae24468a0", "value": "1536:keV7ttRYlTtuu2UwgKNPfhOj7+IsbpXeA1BqCudX:ZV7ttWT0ZPIjKtV4tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139967, "uuid": "32e1dffb-c449-464e-94c6-da3b956d582f", "value": 75292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139967, "uuid": "6d787267-50ef-4fb5-97ad-57d558737e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139967, "uuid": "a7000ab6-c63d-4cb5-aa97-e6c723fb2ff5", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9838cb8-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761113419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113419, "uuid": "708e9ec2-5319-40e7-b866-68e0d3a4a904", "comment": "Malware payload (PhantomStealer)", "value": "6c59d9536a058f2f0560c90d2f9a187b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113419, "uuid": "cd6f54ee-8812-493c-8c8c-411b14fd9df9", "comment": "Malware payload (PhantomStealer)", "value": "17ced68461c9666597e1de5d3a69a219ada895e35c382eae83bd3a41918cad78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113419, "uuid": "33c8cab8-07ad-450e-a450-9f7e6380624f", "comment": "Malware payload (PhantomStealer)", "value": "2cfd3e39c09c261af20a3ce43f1640048bd39834", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113419, "uuid": "d06db858-4a7b-48c8-9b8f-5ee921afb60d", "comment": "Malware payload (PhantomStealer)", "value": "cb7059b28f2306e592250a4dd48ec727067ef1b3593f09f080be05b2e8f2635131faa49ab0337d4da9f2a0d1b1f8c222", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113419, "uuid": "d362ad28-356d-4182-8efe-d7cbe412e8d0", "value": "T13F16028C078D11D77A3113AC1F3BC639A72945BFAC670D0ABD39E8D94F171E874AAA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113419, "uuid": "da15712d-673e-4783-bdd0-0b8d210620f5", "value": "768:kjRXa/tGAKj4117Y5SqspVa/gG+Z95bS3Jn3WzBPmPfTWpeHnQi6RDomt92s+QcR:sJaujkj6+ZjErWpIoDomt03R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113419, "uuid": "2ef4792d-73c8-4c02-987b-58f81b9b8627", "value": 4268315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113419, "uuid": "3d09cb45-c5d7-421a-96fd-d75355339e5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113419, "uuid": "ab2e5759-917d-4c15-9f45-db44b09d0cfc", "value": "Order_PO2144R.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef4476b-af86-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761165237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165237, "uuid": "cb19486c-52c1-4405-9d19-d4a8cefcf1fd", "comment": "Malware payload (Mirai)", "value": "f597984a679aed153dd8c105539fd5ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165237, "uuid": "5a70964f-47d2-43ea-9ae1-ebd61f41bab5", "comment": "Malware payload (Mirai)", "value": "1833ee2831f24b0e3c0adfbf4b6b76444e88a8847290f10728c5449a6c6686a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165237, "uuid": "34501c03-a16c-49b7-a50d-08239f61f520", "comment": "Malware payload (Mirai)", "value": "899e518fa14985fff0bf4e541547a30a07923d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165237, "uuid": "7a5821af-927a-4641-b1a3-3d75c6df8fcc", "comment": "Malware payload (Mirai)", "value": "271acf501d350a9fe4b2aceb24247fa4aa36aa8c4cb13276547e323e2b6a469e2d17b0709b6bb1d225a065cd07cddd2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165237, "uuid": "720abb17-3bf2-426c-9bf2-ddb880df6b04", "value": "T1B7442A46EB408E13C4D627B9F69F02453333DB64D3EB72069928AFB537C779A4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165237, "uuid": "f7c47a42-5f01-4f54-a272-18f9e86bf6d7", "value": "6144:GI88ErpC5OPwtXC0auMPsJP45Tpfa5xRoPqN6GPV/GYna:G1q5fRC0atPsJP45paRqs/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761165237, "uuid": "841f5c8c-9aa8-404e-9e55-d967d14b5b5f", "value": 271999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761165237, "uuid": "44fe33e0-74ed-4478-a0d3-920ee78124f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165237, "uuid": "958efee4-7955-4be6-bc87-fbcbd645bc8a", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245f8cc9-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149650, "uuid": "04b6df26-7784-4b49-8277-9d25da6d7b6a", "comment": "Malware payload", "value": "e0d094591dffe073f6ceba8b75e6bf76", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149650, "uuid": "0cc2f13a-4719-4617-9762-7c368970d88e", "comment": "Malware payload", "value": "185ccd2bba0bf811f04321a6193831f3625ec9b92fd16fb8a9419cf3256717f7", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149650, "uuid": "0bd91fa3-2154-4ee0-9267-66e0bb3e4934", "comment": "Malware payload", "value": "2a52275f8477c9e9f0dc6bdf1742ad0e77b3ef17", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149650, "uuid": "92177877-c7cb-4713-901f-454757369c21", "comment": "Malware payload", "value": "cfde81660ac5b8698ef59ace862dadcf80a9b599a5a73b76658b0bf32d6dba6bfbb00063dca9e318f8ed30966c045213", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149650, "uuid": "2a248761-85f0-43b7-80d5-903fe122ae60", "value": "T13EA1B533C840A55F4BF3025B9EBA9264FDE6463B4A093D90F59E804AAFF611D8216C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149650, "uuid": "7741320d-51da-4a95-97ae-529e31a7f6ba", "value": "96:dIxaprQ4Rcod+G6fzhaLMYGDfocY+5q8QKc8r0YESxVJN:dIApQ4Rxd56rhaLMXDwcxw9IZESn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149650, "uuid": "0c91f9a4-21b8-4361-944c-aa8792b377f2", "value": 4692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149650, "uuid": "76b9edcb-b201-4c08-bee1-143cb9ef30bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149650, "uuid": "aaa87fc5-0e64-46b8-9414-8384eae66f65", "value": "185ccd2bba0bf811f04321a6193831f3625ec9b92fd16fb8a9419cf3256717f7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3109ee0-af44-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761137004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137004, "uuid": "9e0fbe97-55dc-421c-906f-2701f0ff0f6b", "comment": "Malware payload (RemcosRAT)", "value": "05f381b8afda13358911f753f44afef7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137004, "uuid": "2a3d3456-18a6-40f7-922b-72d10bb9da1d", "comment": "Malware payload (RemcosRAT)", "value": "1981e12873bf244b386e58f51e1281f627b82b1a5d9189d766c7627aa586fbad", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137004, "uuid": "cbd9cd92-36c9-4235-91b2-811960dc2337", "comment": "Malware payload (RemcosRAT)", "value": "c17b28621a11a30a87844ba6fb33107ccddb8fa0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137004, "uuid": "b735bb74-35de-464a-b42f-92c584e61587", "comment": "Malware payload (RemcosRAT)", "value": "5039247a9e433960277e2e7853366d67f2681ddc0f81346f066d2027213bece64007a4792e548af1f22ab5893799f289", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137004, "uuid": "47e88d8a-6505-4d52-8396-fc2dce02b401", "value": "T181E5BFB876047DE6266F576FDA96ADDC03B626239ACBA4CC4064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137004, "uuid": "136281da-0f0c-4f3d-9054-ec140c3cac2e", "value": "24576:VWHFXu1Yhmf3ZCCYQWZVbemdT835MgTI3/JS13ZJi2CdG47v1gRvyYkNoeb9w/8K:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137004, "uuid": "35bffe27-f9a8-4d5f-bd8c-c81a32c83a97", "value": 3316792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137004, "uuid": "18637ebf-50c4-4402-aab1-ce9bb46f0e5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137004, "uuid": "63144d63-368e-4ce8-8d32-73e4da7a7b3d", "value": "Fore.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5f32c0-aefb-11f0-91c6-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1761105609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105609, "uuid": "f61c8bee-0e73-40a4-a1eb-0483c0c2e619", "comment": "Malware payload (DBatLoader)", "value": "d8fbf42118f9d8984ff59e3608e93f4a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105609, "uuid": "e95f00f5-4952-4593-b991-ec19b5dc6ade", "comment": "Malware payload (DBatLoader)", "value": "19b4dcc4c0494d1d81ed508f1f97c3bea1cfc71420b8af29775288c2c190ba01", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105609, "uuid": "6606bb4f-1e58-4df8-8959-1cc3b426c83f", "comment": "Malware payload (DBatLoader)", "value": "f7edb4159df05fdcf5a8b5e068d72538a757d312", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105609, "uuid": "75e81667-d5f7-47bc-ab0f-af12aefe1a21", "comment": "Malware payload (DBatLoader)", "value": "320bcd1befdb3b910e818b66cfdc7c906b29eba2a1732c95c971612adc6bbd84da512c848758578f04dbc02d0afc2191", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105609, "uuid": "7aa57b92-02e7-4b51-8ae3-9fd40188f3ee", "value": "T19B756C11EE528D3AF02E3539D82BDBD6191DBEE12A14790E3AFD3A4C7F395C36416092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105609, "uuid": "7221a972-8ba6-4f12-bf66-15aab6b578be", "value": "37cefd31e003cee7c8f3f0b24332ee91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105609, "uuid": "3de82a82-1811-450c-b65a-448c91acf796", "value": "12288:8DY5EcZJ8u/Peh1FKI38zwMN3y9ZISC92vOSUl8bOYp:8c3ku3efFKfwG32uJQPxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761105609, "uuid": "99d1d271-d137-470c-9ef3-1095de85b9c2", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761105609, "uuid": "2e27f92b-3fd1-4575-adff-0e865f9bcaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105609, "uuid": "77934b31-3ef7-4ddf-a3c0-281b5d7b9d4b", "value": "rDHL_Express_Delivery_AWB_39952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482f7430-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761154434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154434, "uuid": "e287e104-2086-46ff-8596-84e8eacea7bf", "comment": "Malware payload (Mirai)", "value": "8c2a439ea64b35bbcb8bc6eb51b43bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154434, "uuid": "104691e0-add7-4a34-af7b-21a7137e92f3", "comment": "Malware payload (Mirai)", "value": "1a16ce155a3f026fcf3158a138278f0ab7be1440a8db7e72251df784238f12f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154434, "uuid": "baa8fe60-345e-4456-a23e-0c270174acac", "comment": "Malware payload (Mirai)", "value": "c4b7a00b363b0527426e53fbe6f48b72668efb2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154434, "uuid": "0a4ad6f6-e152-4760-a5b1-6124ecddb326", "comment": "Malware payload (Mirai)", "value": "7cf0948370cd946b0929082065d33f56716655ec0b58ff345d969548fff7baed0e3a52a50b135c92c174bda073ce1607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154434, "uuid": "e9b420d2-7419-4866-b322-792cbf12aec6", "value": "T1D1932951FD825613C6D122BBFA6E428D3B2653E8E2EA7203DD205F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154434, "uuid": "7510f4b0-d017-4926-8774-9879e925847a", "value": "1536:FWKfB7ByQgaFrrjwg3ZxOb7uf2wOUM9ASbqiO2C/mRrEqyXvrq:oKfB7Zr7C7sOUM95oqMrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154434, "uuid": "8a444369-09e5-4ffa-95db-4e1172e7651d", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154434, "uuid": "a31b1b26-fe80-4cd5-b99e-19e5b928363d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154434, "uuid": "f4804c90-80f0-485c-9209-4b3d30dbe537", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cf3fcb-af6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761155146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155146, "uuid": "773396a3-4fc2-4bae-b555-2c6923333c48", "comment": "Malware payload (Mirai)", "value": "3d4cda5f70bb4e986b819b7c61338cd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155146, "uuid": "136c6dcc-c133-4dbb-bc7e-a2aa8a919595", "comment": "Malware payload (Mirai)", "value": "1a40c995ee22cc4dd250a6d42f22032be431392aa529e4930d6344dc78f3a468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155146, "uuid": "33227bc4-d175-44a9-ae1c-6a2045221096", "comment": "Malware payload (Mirai)", "value": "1ea500c2581cc51fc93dbb8e8939875569487458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155146, "uuid": "8fb65a73-5747-4bef-9657-131313d82f63", "comment": "Malware payload (Mirai)", "value": "99f93d91e7cfd5c9581a0d4e111f45da3816a4c166aad681182e599d4b8692727bde33c27a58d24d4b4c418aa682a69a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155146, "uuid": "9a612afd-8bb2-495f-845e-f7d178627df8", "value": "T1D6041945F8819B16D5C012BAFE1E128E37132B78E2DE72129D246F647B8B87F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155146, "uuid": "b2eadaf0-a5c8-49be-a5df-3ddd30e27735", "value": "3072:Ot9ck23Vtx+qpCIMjtyTvTGXXPnYSlXa9jTarSQ0wrthyAD+8W0:u9ck23D7QIMByTyXXfYSa4h0saADBW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761155146, "uuid": "4c4f759e-8017-446d-9f56-23611f831183", "value": 174880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761155146, "uuid": "a2c61708-e3fc-4b92-894d-cf4d9f3395db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155146, "uuid": "c0c2b54d-b2a3-4426-b806-c3b6c6bca9b8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c0ae1b-af07-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761110600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110600, "uuid": "6ed16b71-0f6d-463e-a04e-16da29f1104e", "comment": "Malware payload (RedLineStealer)", "value": "a4e9d5c526f2b784f7a67f85da5ebb44", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110600, "uuid": "ae6ca5a5-4fb9-4353-b937-01775a9ec634", "comment": "Malware payload (RedLineStealer)", "value": "1af4d963dee6fe5bda969e74c140717a5f1d138ff1f95070e071fdf9802534ce", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110600, "uuid": "1ca8948a-e676-4bb3-be48-579093f82989", "comment": "Malware payload (RedLineStealer)", "value": "9860288f3795c384bf3b0e4d5deaa3f16f416204", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110600, "uuid": "2a540089-605a-4d48-83c5-f222cbcd590d", "comment": "Malware payload (RedLineStealer)", "value": "6425f0f2db045c42e7099e36b49ce8ac0b9ca804e8de85206b48118f113f94deb423894d5b337742c5796cda506ea66f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110600, "uuid": "f056ad02-c56c-4af0-b334-10c5b04d7bc4", "value": "T140C533309A9E3CAC462CD37E343F6D0E1DE14FC2445CD4FA5AE625CB12DFA42186B569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110600, "uuid": "733a62db-1847-46e0-b825-f3d6c040d224", "value": "49152:kCep5z8liBqLiKXLS54fEeBG2LlhwG4Xve:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761110600, "uuid": "ced46e70-940b-49b8-a94b-111621a0bf06", "value": 2688516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761110600, "uuid": "8c9abde3-5513-43b0-870e-07413bb35c2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110600, "uuid": "5a6b3e1b-9383-4360-be20-c5307f13edbf", "value": "ttesttt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16247a3f-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137600, "uuid": "0301b347-bd5f-4292-b7f2-7e16d2522bd5", "comment": "Malware payload", "value": "5741bd198adc05c109f02de80a4b269a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137600, "uuid": "b55b5114-933e-4f81-86dd-3c0800a2be6b", "comment": "Malware payload", "value": "1c705bcbc0e41e97c9f219e2af695b26ac1334048ffa4605df6d1fd213a17fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137600, "uuid": "5374a200-b131-431b-a772-0f17103e202b", "comment": "Malware payload", "value": "7c400a3c3f893891f0215d7085596a3acb10cf17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137600, "uuid": "4ea14677-2f37-4112-b56b-779dc567ffdb", "comment": "Malware payload", "value": "2d3b2752904a3c6d93e9dd81ba746cf7295abebd7caf4fdec075ea46a5b004d4a93c146b08355e22383155e93dd49a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137600, "uuid": "c2c35281-6749-49b1-a701-e6e5b28d82f9", "value": "T1E90633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137600, "uuid": "a9fd163b-5c80-4a29-88ab-81ba60f15b4c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137600, "uuid": "46eb08e5-4b24-4451-941f-c17756d965b5", "value": "98304:aTT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:42w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137600, "uuid": "31c73765-a4cf-4a9f-9dac-c18bcf4aacb4", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137600, "uuid": "c8b4e5b5-bfe5-45ff-875a-b5769142ee96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137600, "uuid": "aaf6b733-bd94-4376-952c-9752a91ce3d9", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91180dcb-af4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761139524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139524, "uuid": "82565238-d257-4dcc-b33b-af7ff42fdd5e", "comment": "Malware payload (AgentTesla)", "value": "57c8422b04fe921fdef3b6b2d4e48c0d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139524, "uuid": "c3089530-2923-4402-b9c1-f88f506b4dc9", "comment": "Malware payload (AgentTesla)", "value": "1cdc003088a5fe13b6939a6fd0d4bcaf7c5cd05aa5a005ac647cfd3700d5dcef", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139524, "uuid": "ab7059d5-2a7e-419b-8568-e7f660423dd7", "comment": "Malware payload (AgentTesla)", "value": "0e673d458a3f3e64cb917d857e9eb428e1611b16", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139524, "uuid": "55c174d0-a6e6-45d2-9e9e-5c0662059699", "comment": "Malware payload (AgentTesla)", "value": "61fb188f970c098f498eacdcaf6ad97ca0615f36ec2b843b9966ae787083ab0176e68932c8b003ee0fc88a5a6f1fc6db", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139524, "uuid": "bcbe021c-1bb6-44d3-b3f8-8a9f2ec4a2b8", "value": "T127D4330888DA882FDE574CD9AF450DDB0E0FA13773ED26BD32439AA86FB5540FB91160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139524, "uuid": "d8c2b1de-abd4-48f7-b84f-58e3f6936a2f", "value": "12288:zBNZRf/nIAzD60Zc93cBYKaQ5FgsGrkLcyGYjGK4x+ksThWSniONwvGiqc87GX:zBNZhI4o3RmarecyGYiK4xlsTfwYc86X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139524, "uuid": "cdafefdc-3071-455c-9979-8bff626b3ce7", "value": 651653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139524, "uuid": "783493d2-4cc8-4782-b6bc-9a0f3fd2cdaf", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139524, "uuid": "cb842bc6-ed19-4d0c-aeeb-ea914d4d3867", "value": "WeTransfer Documents.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b26aee8-af02-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761108510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108510, "uuid": "3dd05ab8-6244-4f29-8500-707b73254530", "comment": "Malware payload (Mirai)", "value": "15e2346c1de6b62050e6d8297fa56e27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108510, "uuid": "015ee4e4-86e2-4302-a488-fc6e9fac3c43", "comment": "Malware payload (Mirai)", "value": "1cf73090e05ef9e3c0336f7acbc9743fc3ac6a6d312abff80f5790700e525ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108510, "uuid": "f1fe4c8a-277e-416e-8bca-4898c94c7797", "comment": "Malware payload (Mirai)", "value": "321514f271dfb04feaba28b8c2c022d0c1f87ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108510, "uuid": "36441ab7-902a-4124-a0d6-08f96dd9569f", "comment": "Malware payload (Mirai)", "value": "2f420b8723228eae14208b6e3edcb73260f645ff8308ca4c512c72c1c779752982046ea089f12b68cf248eb821b7b3de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108510, "uuid": "1d16130b-fd04-4417-bc6d-85baa4112ba8", "value": "T154930957B9818E12C4D512BAB67E118D371267F9E3DFB213CC205FA03B8649B0977E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108510, "uuid": "3c14f515-d631-4f1d-87f2-361f093b4656", "value": "1536:etnwFzj5q+AYSIXG8XiH+wfqOniSS9Tb+uUeo0p5zYIji30VEw2gBKdhQz2aj+:lK2AyOnTEl00VEw2gBKdhQz2M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761108510, "uuid": "a6ba2f68-ed09-4cf3-9e46-9689ed8c90fa", "value": 89736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761108510, "uuid": "dd4f8531-9290-466d-b3b8-015cbc7e5cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108510, "uuid": "a0aa20b2-f273-4e37-830f-15203dbeb9f3", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bfe00-af26-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1761124207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124207, "uuid": "3882e924-6c00-4b75-9b78-d3d849ef71bf", "comment": "Malware payload (DCRat)", "value": "0094e9198a63ba831db0c65b9f748aa3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124207, "uuid": "c87cf2c6-dfcd-4a53-94df-37cf7254ab8d", "comment": "Malware payload (DCRat)", "value": "1d3227d59735f14311c66a990fbafb2528eb7b1710b5dec6de1c600e46c36cfd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124207, "uuid": "3bad5be3-baa6-481e-a711-2c5240042b12", "comment": "Malware payload (DCRat)", "value": "4f62568da5ae4410627509dff87667e267cb788b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124207, "uuid": "4a8451ec-f641-46b1-8669-4b428acfb758", "comment": "Malware payload (DCRat)", "value": "50a286d0f0d916533b7df6474b8a9b4dfcec2cde62462ca785b0da28dd658f778632b58577a89f5f8641c89a91d8200e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124207, "uuid": "361439dd-c02c-4ddf-9746-b6741a1b8867", "value": "T1D8A5BF06B6D28E32D3A117318597563DA2A1D7223A11EF5B360F20D6AD4B7F18E721F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124207, "uuid": "5ee376e4-b55f-4afe-a08c-5a367667d814", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124207, "uuid": "dc7ef3a9-372e-4d64-a271-8def717c439e", "value": "24576:2TbBv5rUyXVKwO8k+1KDFhkJeayqtnVw2bji1HpPMbSiJxnAkC4/870gCBCKS8Gw:IBJB1mZqtVwD1dBiJGxe/T48xTYcQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761124207, "uuid": "8cf07358-ca25-4d71-8970-1cf612a060cb", "value": 2236342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761124207, "uuid": "2435db69-0daa-48e6-962f-3566351d3d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124207, "uuid": "21631c8b-d25a-4d48-991b-651b10339ace", "value": "0094E9198A63BA831DB0C65B9F748AA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a5a1b8-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761138347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138347, "uuid": "34f3c6a0-f38e-4437-8b8c-a50ffa4bc475", "comment": "Malware payload (PhantomStealer)", "value": "c4fe9b8103301db0f9ea76c5efd14288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138347, "uuid": "946327e1-2834-4db5-9102-cd0b2275d095", "comment": "Malware payload (PhantomStealer)", "value": "1e1a5e570fcc7175e7bf0cff282be1dfb5de613eb19d0a47d666c429ab7668b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138347, "uuid": "2b1145bb-ef93-4a88-8c8d-ff3944d3b59e", "comment": "Malware payload (PhantomStealer)", "value": "5eb2eb56a609450ef711ecd0fe8341850f401bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138347, "uuid": "77077a27-5195-4d50-9081-3a217b5f7820", "comment": "Malware payload (PhantomStealer)", "value": "cda9c822bb97fa6251a9258de149b641e72672dba5563f44269bd151199ab474bbd77b9920fa283a382116f142ce2f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138347, "uuid": "73fdfb90-384d-45df-a10d-226d71d31893", "value": "T16D4512096B1EEF02D9C257F24970D37523B0DD09A811E3124EED7CEBB9A9F062959B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138347, "uuid": "a460b1ce-e64f-4873-9ee7-0d287dbe5596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138347, "uuid": "7d885a3a-0d18-42de-8125-07b93c0cc5ec", "value": "24576:nSf7AuzPK3M3Kf2Pot+T3NZw8o7NsldorH6t7u5dzrHBFPd2mnaz:Sf7AuzPKmPqoNdcNU57u98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138347, "uuid": "7154a122-3469-4acd-8586-b99a8dc88b7d", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138347, "uuid": "2c6a92e6-621d-4bef-97e7-ca41e91e9199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138347, "uuid": "80e03789-5f7c-4548-9bbe-688e1947f705", "value": "Dekont_21102025,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66744de-af1e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120769, "uuid": "3734a212-2024-40a6-a3c4-345087267d48", "comment": "Malware payload (Mirai)", "value": "29fc2df44b2f35fe36a78f14ea201a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120769, "uuid": "766bace8-88c5-443a-86a8-1c4db46fbd41", "comment": "Malware payload (Mirai)", "value": "1f18c0aa35ed69699e5940e5466858684823060977fd2612558e3071ed6efade", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120769, "uuid": "70effbdd-5e23-4bb6-b225-617aab381833", "comment": "Malware payload (Mirai)", "value": "79aef646bdb8bd4c4a18ab0179f7512f17253183", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120769, "uuid": "dac3d7ac-55cd-41eb-b62a-8bfdfc3e480f", "comment": "Malware payload (Mirai)", "value": "c140fdf17038568bd247f96b4c2adf0004cd22b1fa591b92b703b1c6638d363782945f0489a76755b7f1b4e750bdaf84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120769, "uuid": "b7725d83-d926-43d4-8964-160a139c4c94", "value": "T13323F13C250611DBC4ACDEB4F3E857311F290A266802BCCE56A4AE439F6B0D8F717679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120769, "uuid": "d13159ea-a138-4522-8f66-345b42294974", "value": "768:j21rDeRRUQlHCjdNMMArJqnZhJjMFSRlbNvxbMdTJgGlzDpbuR1JJ:j2xDeRl8dNMfdsZzjpuVJuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120769, "uuid": "d9b98567-d4d7-4d65-a97e-97096ddd1426", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120769, "uuid": "50913b30-205f-49af-bcb5-96b89b941636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120769, "uuid": "b90e6f9c-d7f0-47fd-9d51-23ba9d9db8b6", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747596ee-af3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761134322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134322, "uuid": "67be4165-7ad1-4e2d-a33c-ade59c718df5", "comment": "Malware payload (Rhadamanthys)", "value": "7bd9f8b2885bec87a7fef4173893ca7f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134322, "uuid": "787cfa69-0378-429a-b13e-f29285635e2c", "comment": "Malware payload (Rhadamanthys)", "value": "1ff9beb3f6d8ea364d204347bf5bde0cc7d2ad68e0071e62337acb301987b95e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134322, "uuid": "811c3c73-2cdd-46e5-a83c-7cf3c6801af9", "comment": "Malware payload (Rhadamanthys)", "value": "63dea959138f3dd0c188515c4c521c862a37fdfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134322, "uuid": "7e7d4558-9206-4224-b984-588665365a5a", "comment": "Malware payload (Rhadamanthys)", "value": "bbee74ed9e7b95156fe87ac17505cf0765dacd3abd521f3f356bde9abd035dd9650ebd181879aaac3c01fe2fb4449c0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134322, "uuid": "34915f9c-ba01-4817-8dfa-abbd0ac5315e", "value": "T14156AE1493E800A5E47BDB34CA56C333DA70BDA24735D50F0999E2461F77EA28B6F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134322, "uuid": "439adc54-716b-4e1e-b8ac-5accd04da7b3", "value": "28ff749744214e39db4a95c0cd62dbef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134322, "uuid": "c0567862-83eb-4475-8d4a-7d4b24b009bc", "value": "49152:hXIxX58V9jt/3ig16WZGyEfiXf+1oCA0iOMAeSlEN/ilT/vWTEkHuKjm5KwDdp6u:5b4W2iURjzI/W/eMp6s3kQl3MDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134322, "uuid": "0b1b1aee-a9da-47d4-b6bf-754bde82060d", "value": 6411776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134322, "uuid": "81300299-1af3-4b01-913d-51e0f7015aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134322, "uuid": "4f9feddb-1f1b-4c6f-abe9-9231fc9aa18f", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a24ee-af95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761171742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171742, "uuid": "3020c608-25ae-4ecb-a692-44b346a3b644", "comment": "Malware payload (Mirai)", "value": "dc394bbd634321f4e9fa0cb2e3fc062d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171742, "uuid": "27fb5300-9112-4171-aaba-3257d0cbb29c", "comment": "Malware payload (Mirai)", "value": "2164f4ee612bf77b8e0ecee19580ec57adf865813dfa9f6e5e04ff2ce1cb2d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171742, "uuid": "523c523e-dd19-4876-b883-30defcd9bf50", "comment": "Malware payload (Mirai)", "value": "daf0d566756be8b2d18b55ecedfa6e12b4bebcc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171742, "uuid": "1fc1d6bf-7095-4c85-bc37-1b86754b77c8", "comment": "Malware payload (Mirai)", "value": "18b328cd5c6a4eecf32973dd97807f4288306a8e56dfe0dd54009cb605adc7a84c173f0c4b0e43f581d7c4cc6fb99c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171742, "uuid": "d38e4931-ee49-48bb-821c-f52ddea0063a", "value": "T136834A22B27C2B27C4F0A67911BB637376EA2A850464C38FBD650D5F9E633D0185BB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171742, "uuid": "2df3c297-cbc8-4e1f-9448-8db38170035f", "value": "1536:M1YQOTbaJ+IJchLqSa5LRX6N11JeymCvEGqWaWMEooeNJHxCAiBU9pePGlKZ1Zjr:/bPZIQAK11JeymCvEGqWaWMyeNJHQMpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171742, "uuid": "6e71ed05-9726-4cc7-b30d-3dab9899994e", "value": 85812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171742, "uuid": "6b952805-f1f0-4e04-91c9-b804a0983be1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171742, "uuid": "25ab6638-758a-4fad-9f8e-1172b3cd2879", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa604bf-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761114369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114369, "uuid": "11d40d72-f038-47a6-bce3-d46c4f2ab765", "comment": "Malware payload (Vidar)", "value": "f6115669efdb288619c8b93b18bb5914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114369, "uuid": "8a961f77-b73c-49f4-9665-9833e74c336b", "comment": "Malware payload (Vidar)", "value": "21c00859cb0f7097342c790a271a657de49cc2da5c6f6eaca74012dadebd7fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114369, "uuid": "88585921-91eb-4da7-8219-6e25f67fcb04", "comment": "Malware payload (Vidar)", "value": "6eed246aa2c7f3138f020ddb9593ee9ecd1ca191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114369, "uuid": "03f41dda-05ea-453b-acac-277d871b89c6", "comment": "Malware payload (Vidar)", "value": "156d2bf3186e8e928fae6b8ca16f75152d0cfca56af3c84254d86eb83a78da7bb084236920a75f7417eb13b7d259b7fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114369, "uuid": "d4b622ac-c8b2-452f-b20e-de85fd0a50b7", "value": "T1FEF56C03EE904999C45992BE85A2A1997FF57C891B3133F32A48F77B2E766C04D363C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114369, "uuid": "59674571-005d-40da-9f6e-9882756a8dfe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114369, "uuid": "02c1ab6b-8d74-4774-a692-237ecb5ea779", "value": "49152:jnLhLICtDMz+4HezSZ14qxFDpbtDznGaILY9oQWQNMthe2:j/4l5btDbG389ZAthe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114369, "uuid": "22339baf-3714-43fa-9334-a8938eb429fb", "value": 3387960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114369, "uuid": "43acd2ae-f26f-4960-929b-da4cff2ca060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114369, "uuid": "71c5268f-b6d8-4008-9c82-b911194a1a42", "value": "SecuriteInfo.com.Trojan.Packed2.50046.19088.22079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336dcad1-af09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ligolo)", "timestamp": 1761111450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "57655605-c161-4da3-a953-80f55d3f237d", "comment": "Malware payload (Ligolo)", "value": "cdc1f6182916daa2607ba19108e03b44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "05591b2c-4ff3-466b-ac68-a8e47bb36be8", "comment": "Malware payload (Ligolo)", "value": "21ee713585ed802b675b7144f7ebd875573e09809c2dff21e65da3d127fdca71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "1ee98540-5101-4947-8c54-49aca2299e35", "comment": "Malware payload (Ligolo)", "value": "c308137f40208577c649796f2e6e970af1ad8abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "698498a9-a021-4db2-9eb6-f1aa4b4f9a38", "comment": "Malware payload (Ligolo)", "value": "8f28716a58c7d931c18139e8069a70284420f287c8fe9a6c20208a474a2ccd9ffa5290f7961b8f41e66c31cfb2e5f1c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "d2240976-2bb4-4d5d-8e73-16c86cc69aa3", "value": "T17E664A43ECA555E8C0AED231C6629653BA717C494B3127D72F60F7382F76BD06AB9B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "ed406f47-62cc-4214-a7f4-1f6589089cdd", "value": "49152:nQz6kMmincYBIgdmh2RhP6nl03BmDZKoZ6gQ/wjaqOzqTom4D5EhynB6WcECKX/T:nGyIlK/wZwo5dcEs/8KXdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111450, "uuid": "48d200f3-35b6-4a18-87a0-9a5857b9f41c", "value": 6475928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111450, "uuid": "163bd329-47dd-4254-a56e-c181238cf664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "edb6acad-1218-441b-9f3a-4bb2c7922c9b", "value": "agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e88537-af3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761133866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133866, "uuid": "5792fc59-220e-494e-a7de-3c59f184029f", "comment": "Malware payload (Mirai)", "value": "f3285b08f8211922e0f1fe23d3758cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133866, "uuid": "a4cc08df-67cc-493a-8d56-2da775d5e378", "comment": "Malware payload (Mirai)", "value": "21f7ccc8de0911d309208cc6f51d5e1cf1e1f9030c34682548d79c7b9853312e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133866, "uuid": "6c8862bb-49c1-46f8-96e6-5c6950889493", "comment": "Malware payload (Mirai)", "value": "810b56e7ed38cad94fea2bda53900e90f6cb9773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133866, "uuid": "e89692de-5115-4fc6-9369-b4b644a57795", "comment": "Malware payload (Mirai)", "value": "b49d07e7b7aa5ca7bb8a04b87440b3696c987269b1ee5429947e1fe245db1467ba440e4e7143509b9e47499329d04383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133866, "uuid": "55a06c3c-23c7-43ff-8997-cd6999987a74", "value": "T121C31A45FC405B23C6D612BBFB5E428D3B2A17E9D3EE720399255F60378685B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133866, "uuid": "c1862228-5b52-4ba9-8af7-8da437e40439", "value": "3072:ZKaprehXXOXWFh4UXAMFwL5RJvWp7aPd:ZKpeXgh4UQMFwlRJep7aPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761133866, "uuid": "352e1acc-fc20-424e-a56b-e07f4a1263a9", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761133866, "uuid": "2801b5bc-3e86-4f74-bef1-003d9971bab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133866, "uuid": "2e7b62e2-06a9-48c0-aa47-59e2a36ffa3d", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7617a8-af93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170841, "uuid": "cdca9e18-eea7-4445-ac87-406338ded0bb", "comment": "Malware payload (Mirai)", "value": "b896ab0043b09bb9c528da6de55527b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170841, "uuid": "3e3158e8-094e-465f-8f5f-4530c2d3d684", "comment": "Malware payload (Mirai)", "value": "2231e506050d86fed9272baaf825a496d836f59b4f66aac44dd74800fca3fb2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170841, "uuid": "5a8569e4-7c43-447a-a984-26d4add97700", "comment": "Malware payload (Mirai)", "value": "a6c348b71f90df4a01475d94eae45e4e730b5047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170841, "uuid": "c3556e07-b811-453f-b9bb-32d5e446781a", "comment": "Malware payload (Mirai)", "value": "168d132bd59919de58663636d022070febdee003ba46ccdf51847a09da62752b375be09f6c75ad751da0e0479d3807e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170841, "uuid": "6976ed17-6914-49d5-880c-5f2e4e453afb", "value": "T17D245BC7F800DDBDF80BE7774413490AB130BBA254535B37725779ABAD3A0921927E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170841, "uuid": "a96a6add-a3fb-4e8a-858c-e59e47796f8e", "value": "3072:N81F3UF3Xi5jwRQ0jHY4pKCPiuW9iFy0LLdBiCzWbT19a/QereVajbi5Lo7+kXLj:8F3k3y5jyjHG4Fy0XdBiLbCYerkLoxbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170841, "uuid": "9c3b3c58-b0c8-4082-a832-e1c818a14113", "value": 212576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170841, "uuid": "e82b180f-c78d-4d99-9f56-ef0af2eb6907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170841, "uuid": "8e5188a1-d7f3-4055-810f-b84496f84fde", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37d1240-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761173592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173592, "uuid": "6aa5ed38-1ff4-4eee-8c4b-be3a50ed6c21", "comment": "Malware payload", "value": "e1ad0428ac805700915bf6693c55aee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173592, "uuid": "de7ea83b-4227-4b0f-ae71-6651305b69e2", "comment": "Malware payload", "value": "259d1ce1e037c1e7d841a44a2f0eb5aa11943ecc47d6e0052f303dc8180da5d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173592, "uuid": "f1c15211-8561-4348-99ed-7d033d1eb46c", "comment": "Malware payload", "value": "bbf019b10550f8385059cffca1cadbb02f550078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173592, "uuid": "86ba40cc-afc7-4bd3-b160-b70738873276", "comment": "Malware payload", "value": "dddef0d8570dd9fb994367954ed9f44d347d2321fe3e146a557171cc379d2f08a0b2db646494fce640aa720b5a80e763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173592, "uuid": "25c6ac17-de4f-480e-8c99-d167afdb8b75", "value": "T1EBD3F886B881AB21C6D156BBFE5F419E33131BA8E3DE3203DD181F6477CB94A0E3A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173592, "uuid": "b910c984-94ae-47f8-9b69-2dc05660bd3f", "value": "3072:1PftMhswu4G3t0d1/IqCXwpx3exx+FujI+z4jC371vwnzCc+:1PftMmwu1t0d1/IjXCx3eoujRz4E1cC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173592, "uuid": "7bad47a2-9e4d-40ac-8e03-57f2c86d6df5", "value": 131828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173592, "uuid": "ab8eb9fb-9799-4fec-beda-06322c024367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173592, "uuid": "221a0319-e387-41b2-8352-90e6f83cfdbd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65df327e-af91-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761169946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169946, "uuid": "8c56d6a8-07d9-4534-9366-733ae1be9b0e", "comment": "Malware payload", "value": "854a9472b62c81a725112ee64db86147", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169946, "uuid": "a6cf2127-a0ef-492b-9506-e2511ad3bad9", "comment": "Malware payload", "value": "25c35a21cae9f85db30ad06ecb221003d838a5adc313c641ede21c4d727be8e6", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169946, "uuid": "4889987b-8abb-42bc-a7eb-0e98f50ac0cf", "comment": "Malware payload", "value": "f5bb04df89945cc54918c5ad387a1cdf6ca0f377", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169946, "uuid": "5b58dcee-8881-4457-87a2-7f6e1966e47e", "comment": "Malware payload", "value": "fea6914311fff1eb152026c19784ca9b9b0f379e825b97e0c8a93a6e8610d50ce41ea0cde657fa7ac8b7a985826e1e9f", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169946, "uuid": "affb3b9b-ebb3-4057-a182-c64a288541c4", "value": "T1FF0533B8666C3592EC4034F471B8BB792DB426DB25E95830FDC7F4602DC9226AB617C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169946, "uuid": "0e63cf22-3785-4d63-ae6f-e8638c2c3a78", "value": "12288:7tEYH5QCzC2Lekh7HmGM1vOLBItq44gELBiwD9scpvM72axBtGLbe0u+C/jOvKMf:ZlH5VzDLn7usitHELBNaJ7zx2WI3ycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761169946, "uuid": "05c0654b-85d4-4a26-94fb-9a7b30eaa3d6", "value": 822104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761169946, "uuid": "e17d29ea-9433-4354-995d-35ecad3934f4", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169946, "uuid": "f9cfc6f4-f0f5-41cc-a760-8693883a87af", "value": "Installer.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704d65b8-af74-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761157508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157508, "uuid": "693263a9-39d9-466b-b34f-b661fd74c5bb", "comment": "Malware payload (XWorm)", "value": "0694d7f7929d4b4acb778117987f483c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157508, "uuid": "fc6780d0-ae5c-417f-b71e-06aca3fd6e0b", "comment": "Malware payload (XWorm)", "value": "260433af788ea2c8a7adcf407b4e1d6458c0ae8ff3a2b9f1e920dba44777a2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157508, "uuid": "bdbe27bf-3c93-4298-ae8b-f8b6c829790b", "comment": "Malware payload (XWorm)", "value": "5dc4166a0eb75d321afaa2a19a7e3daf7b379a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157508, "uuid": "ff63017e-0f83-4764-ac06-01bce70de202", "comment": "Malware payload (XWorm)", "value": "a47bad537f90316c214910f62846c018bbff0027affd561177700d3078fededf170cb92d77dc9fd0935f3c76ff6ab00f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157508, "uuid": "6bdc65ce-ef9d-4d3a-b78a-69b0449571ba", "value": "T123035C887BD44222DAFE6FFA19B372070730F6078D13DB5E0CD8999A5B277848A453D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157508, "uuid": "dab7a843-1345-4684-99f8-3fc121d97892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157508, "uuid": "028d39b0-e830-4419-a6f2-408a3cc00c24", "value": "768:1nbjyIrA4v5AcksKyJYEa7FWPa9PVOwh2au8P:9bj0W5A7BFv9PVOwIz8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761157508, "uuid": "b973944c-e8ac-42ba-a661-e7711a1d964f", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761157508, "uuid": "8c809d0b-2e8a-4310-bf75-c3d6122eeca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157508, "uuid": "440c54a1-d2b7-4062-9571-8ab0a49d35ad", "value": "0694d7f7929d4b4acb778117987f483c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e7cde0-af67-11f0-91c6-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1761151806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151806, "uuid": "5cb5732d-1354-4880-9cfa-8d0d011b8bea", "comment": "Malware payload (VenomRAT)", "value": "e4562f290c84240ff91d97daac392357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151806, "uuid": "77dc5359-1d8a-484d-aa94-3a2f682a4711", "comment": "Malware payload (VenomRAT)", "value": "26adf732be63c8bc0f0efc3ea21dbe8ac4f81f258ff52873a00caa88fc1fdcc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151806, "uuid": "505b954b-bbb9-4a56-9800-b12cb2152e2c", "comment": "Malware payload (VenomRAT)", "value": "65771a26c55a9620ba4827812209504f6bc0d608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151806, "uuid": "44551b73-fa4c-48a9-9200-4dbb3775d0be", "comment": "Malware payload (VenomRAT)", "value": "1544588066d9cb16197c2ab470c3075c2ca79231088f4c8398394d2a061499bd0947376f2acf5a31c40cdc02a5ee1bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151806, "uuid": "4f947839-1309-4ee8-bf29-6d29d50aa4f6", "value": "T13BB49ADD695029FBCC3F47E4130D87894AFF97B1B29B8CC9A8851A57CC4E0678509E8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151806, "uuid": "a1d1659f-ab63-4376-bc12-a0729950c6a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151806, "uuid": "e18560c5-a391-4ade-8385-e060c374f378", "value": "6144:7nArtNVcKngZTVb5FM+7ciJczVFKAPLpgFgiM61:kr3VqBb5aykKAFgvM61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761151806, "uuid": "b526a732-2f3b-47e2-9418-9407d9e8a6d2", "value": 507680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761151806, "uuid": "4de054bd-b00e-4e18-800c-8f9d1f57ebf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151806, "uuid": "a3938af2-d03a-4c9d-8238-e221ebbd4d5d", "value": "hkcOI9W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb5c312-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761149877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149877, "uuid": "b1a79343-3aeb-4c9b-b0da-f271036b0192", "comment": "Malware payload (Mirai)", "value": "675d862ecebf4370463889a38636a314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149877, "uuid": "dc67c22c-b16f-4c63-8601-69c052138af3", "comment": "Malware payload (Mirai)", "value": "26ed7bcce14343040dca3ed20cfd8eb2ed45862186908dcfc03d47f663025014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149877, "uuid": "f3d94ee8-162c-4784-9f9b-96820d38c244", "comment": "Malware payload (Mirai)", "value": "feb8f8579b4d495346350c0c4cb55911ae185973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149877, "uuid": "f29e50ff-70b9-47f8-a9b3-5e2958feda37", "comment": "Malware payload (Mirai)", "value": "29aa70cf0629c726e61458ac2d69e713dc9f0f9bb01690279e56bbad47ee3e56fea04c148597d11276f9361e7e05c63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149877, "uuid": "3b73b9a2-aa35-45c8-a9f2-4b6853214b4d", "value": "T129730253FA6F85FEC8B2E9712C1E7844E8C65C192C570B9142EEB2EF7BBB9446911C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149877, "uuid": "70219648-f82e-4ccd-8f55-b64968550b04", "value": "1536:wJK285Tdv3mQ8gG2DAwG41GR+CZbhE4LgROlHwmAc:X7RmSG34wZbhEe1Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149877, "uuid": "bdd23411-1303-4105-8448-7bd755f11a43", "value": 73660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149877, "uuid": "1848f7b4-7bae-4210-91c0-226268e028c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149877, "uuid": "ecab690d-afdf-4853-be12-4fdca48a4ce4", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bf55a5-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150434, "uuid": "23c4351c-37ce-4d33-a80d-47bb27876e38", "comment": "Malware payload (Rhadamanthys)", "value": "ca50c8a3a3fa36a3993a79abb56d607f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150434, "uuid": "675de1a8-a2c5-4ade-af3d-bc209cfef02c", "comment": "Malware payload (Rhadamanthys)", "value": "287eabd82aef01dca3881a63bd6edd8bc5364266b1c35ae8f2738b516504c730", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150434, "uuid": "7ad05705-d624-4c0d-ae02-8bb1ce73e832", "comment": "Malware payload (Rhadamanthys)", "value": "f5e40cdb0a37b0ae9cd82f33da491b892bf088cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150434, "uuid": "a3e6f3ed-71f9-4106-82d0-b635f39824b1", "comment": "Malware payload (Rhadamanthys)", "value": "d9c343d3d0558d101c3632047118919d3a2219351633fa25dadc7e429a797a27ee81404456ca9340e5d9f6659e99e696", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150434, "uuid": "df1dcf23-75fd-4cae-97af-1ee21b42e5d8", "value": "T1B0A319384F3A50783C12B1985FEAAE538358975248A1F29129FDB769FD14B3FAC78740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150434, "uuid": "646b2f4e-37ef-4b72-ae7a-a73d8ff8c88c", "value": "3072:GDB7b0b+y+6AKg+s+9C+h+L+a+q+X+Wli6BkQWkp:0vJRKrv95k6xhOM3Wkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150434, "uuid": "e3d8f8b8-613e-43c9-8119-23ff6a34303a", "value": 107274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150434, "uuid": "31e4aecf-fd7a-40c9-ad35-1d5b3bdae7ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150434, "uuid": "fee389f8-77ee-47b5-93fd-04410bdae469", "value": "invoice-1637482117.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7897826-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138354, "uuid": "ee35764e-0b35-4625-962d-ba562bc1aa6f", "comment": "Malware payload", "value": "2917f473b5d3d49d5732ff34ea195562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138354, "uuid": "c81dfd90-6e3e-4780-a1cb-cc9ea8c06910", "comment": "Malware payload", "value": "28e79c50812ee9416d7dca4d63e04f11a11e2faa8944e84a7cd3e655ac68f501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138354, "uuid": "2af9fbe5-e75f-4e0a-9872-0787f7d74c46", "comment": "Malware payload", "value": "40605adaaa341f4157f472b323e012eaec9f690e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138354, "uuid": "6916f827-61b3-43f4-a747-919e0e5e73de", "comment": "Malware payload", "value": "d94618a7cb0dc69f8a81be08804490904e5cee989c48adfb94896f24877d36625411e3a20348e0f189ed9e7779b5e01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138354, "uuid": "f2974f0b-c1b6-463c-b5a9-0102270dd836", "value": "T132F412496A6DDD12CDD52FB65A70E3B021389E4CD920C3038BFEBCEB7529B85285D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138354, "uuid": "c8b1c1e5-a3d1-40f5-9661-e26deb8f170e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138354, "uuid": "2bf451d8-c889-4e7b-b251-f29e70d8be55", "value": "12288:CYldk8o1xjzediAD7S0Cquo6CZmDYMHdFePrrcbKo8c2XZKPTE:CYlu8Uj6iA3CquaZWFe+bAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138354, "uuid": "e34c0f00-7107-49b3-bd8e-06f15380f825", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138354, "uuid": "ac648a85-4fba-4bcc-8b04-6a577761c742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138354, "uuid": "f4539794-0eb1-4806-8949-3f7f8321cb88", "value": "Fiyat Teklifi M\u0130F846100410046846.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5abd621-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761150430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150430, "uuid": "58b7df03-f1f3-4f9c-8279-02a553868375", "comment": "Malware payload (CoinMiner)", "value": "7bcab37c15aa4987a11a18e18314834b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Barys", "colour": "#A76A32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150430, "uuid": "94890272-2412-4c59-a3f9-181e11600233", "comment": "Malware payload (CoinMiner)", "value": "2a097315860e35147e0c5b61d84460b3ef0b50508e907a3a6322aed75f940fd8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Barys", "colour": "#A76A32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150430, "uuid": "f65f248d-707b-40aa-a38f-fed05a2e752e", "comment": "Malware payload (CoinMiner)", "value": "fd3ae2f003e9d682c9e25271510c167f79b77f72", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Barys", "colour": "#A76A32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150430, "uuid": "6ed73f11-eae7-4d1c-ac58-821bd8d22c4a", "comment": "Malware payload (CoinMiner)", "value": "f96a446bef4984a5fdf1b6d8cee916ce436cfc33873c3a69175db6306e5aae99c2df30fb4fe6f333fb333fb937f7c910", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Barys", "colour": "#A76A32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150430, "uuid": "f3ef5a99-f351-4bf5-a34f-8bb9b5c0c4e7", "value": "T1C59633D1FF486DC6E306B2B60143B47DA01E39A790804A4E118D31B99E737E956BBF8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150430, "uuid": "5608ee5d-9b8d-4668-b189-67906861b47d", "value": "6776d1a14285e6e41d63673627273c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150430, "uuid": "79ed3aef-911c-4f72-a3ef-1b861a9c722b", "value": "196608:zhvdxleWcoHPwRxcSFJKDYe5LYtKsM6WDZMLYC40m:dvdxHcoHPwfcyJMLBnrDaLYC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150430, "uuid": "ad5ba31b-202a-433e-9c72-0311e8113397", "value": 9062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150430, "uuid": "d1fb25b1-d5e4-4329-879d-516233eaef09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150430, "uuid": "65b507b7-063f-4092-ba99-d1761bc51303", "value": "dialer_java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c35f703-af10-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761114605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114605, "uuid": "f36762be-be7a-47a6-a317-6dafbd1d5187", "comment": "Malware payload (RemcosRAT)", "value": "2eedb5a937b9d89aabba9dc69e8d91b0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114605, "uuid": "6ab32fe2-c323-4622-be4a-30909c29e131", "comment": "Malware payload (RemcosRAT)", "value": "2a5f4d56eca43f396ff202496a080985afc22280bead4333b8ba98bb71885d6e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114605, "uuid": "e70ed477-e397-49da-8a2b-d85d59d64e80", "comment": "Malware payload (RemcosRAT)", "value": "75b1c94c401545c379d2bf30706f022dc0cdb2a8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114605, "uuid": "5905bf14-d86b-4953-bf87-2ad2e7c6e7a9", "comment": "Malware payload (RemcosRAT)", "value": "1518df7cdb0c2d153dca48af8e89b78a89f933e6fbda617e2e0a98c5ac63e2378d62ea4d9d4460fee99fdd90d749106c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114605, "uuid": "2984478c-27e1-4c00-8c16-2b6ee2d8da83", "value": "T1A6E10F49A5C0184D71F6C3369A5AD4AEF23441D77B62184E7C1FC8692F36BC3A81B3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114605, "uuid": "a22ffcd7-8a01-4aaf-9232-9ff0da1da03f", "value": "96:uPfGhdX+8XlblcqCaJHKKOxTul0j6wLdV6WhGtWkrSrmwR9zDS:uaBlcqC4HAxTBGtWkrSyk9zDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114605, "uuid": "5150e648-16bd-4e9c-af3b-f0776985d7a2", "value": 7445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114605, "uuid": "eb7b4e65-7f6c-45d6-8536-e149f04d72d7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114605, "uuid": "2c26d5cd-ec59-4c0b-b21a-442135bb35ac", "value": "rRFQdrawing.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722564db-afa1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176838, "uuid": "ee9c037e-498b-4f98-8c01-14d13c6d463b", "comment": "Malware payload (Mirai)", "value": "fc41e7e15a2d5211c878431983deab19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176838, "uuid": "b3f51cf4-68db-41a9-8e79-b04139a74911", "comment": "Malware payload (Mirai)", "value": "2a74a760e6e01c25445a1b8fa5ae48899b5b337207a197e7ecc59e0636a38d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176838, "uuid": "1a138542-9ec0-42b3-bffd-c972ffc55dc7", "comment": "Malware payload (Mirai)", "value": "f72057c6e6a6e96d572503deb0b447737be79bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176838, "uuid": "8a18a8f5-032b-4691-86ea-6e737c09ddf7", "comment": "Malware payload (Mirai)", "value": "ce242aefa239d076f4d4e4491fd5625c3de4f09d1752f7d6768fa27f3f280423532cc3c950285fd61471327af0cec311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176838, "uuid": "9e95a810-bd8a-481e-9f4c-c1b8a53ed3f4", "value": "T1B3833B89B8028E7DF80795F940620E09BD2173961ED31F17A6BBFCE37DA21D56E12D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176838, "uuid": "45c4e56f-d6e4-48e8-8dd0-628c05facae3", "value": "1536:yRsf6/26Lvnf08HjDIxYJso8LPhjG/gzexh2oXI:kvnfnHjc2eJcgCxh2oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176838, "uuid": "bb3bd21f-7e35-41fe-8f64-62a7cc425361", "value": 81644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176838, "uuid": "f31a247f-e1e6-4e31-b6b1-7a14a77d3d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176838, "uuid": "c647549b-5666-48b8-8da8-2ce24993aadf", "value": "kwari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5baab3b1-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150601, "uuid": "c94ddb0a-82e1-4208-9dc3-9e5c7421ee28", "comment": "Malware payload (Rhadamanthys)", "value": "4f0e9d151e181f1de084cb75708f6c74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150601, "uuid": "da0ddf78-d8d4-4b79-bf6d-13558a4f8496", "comment": "Malware payload (Rhadamanthys)", "value": "2a9e91d713c560c80039e175e6929081d9dfdc4423eee9d5e87e7267d918de98", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150601, "uuid": "e98db831-d835-4777-a6fe-7d4cac5df4c1", "comment": "Malware payload (Rhadamanthys)", "value": "5afde4b9c7f97314ac2c02fd51971623ca8b3816", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150601, "uuid": "091c3fe9-89fa-4293-952f-339d23506178", "comment": "Malware payload (Rhadamanthys)", "value": "a66987e07d181974f516527d3b959d5d2e56a612530f45c1ac62231efeb901a20c1799b2410c71b218c67bc7117ce9f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150601, "uuid": "fb81be3b-ac3f-475b-a17d-2abf93b05da2", "value": "T1F1A307E97D63F9DA0A8E15833AB833168B39D492C81860CC9155FF1A146DE6D2C847FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150601, "uuid": "9126df9d-d8a9-4f2c-9c7e-69f3b888ab00", "value": "3072:GDB7b06/vO/gEoh4d1mXOmOO/int1WnAZSSwsrZXzmolHRRYCinYInjfl2cnt2kc:03/vO/gEoh4d1mXOmOO/int1WnAZSSwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150601, "uuid": "395afdfc-9a21-4108-b121-c82ea2eeb158", "value": 104650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150601, "uuid": "9de9bce0-4f04-4324-b319-0cfa7198ef8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150601, "uuid": "bb713ccb-1fad-4175-b0d0-4cdde1950752", "value": "invoice-1637482117.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5924da56-af13-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761115808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115808, "uuid": "544f960f-90ea-40c7-812b-2bf7824868bf", "comment": "Malware payload (XWorm)", "value": "18b6fd06eccc7b0ca8a5a6aebede3aa3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115808, "uuid": "c3956ddd-7c4b-4568-9576-a7dda5c9d9dc", "comment": "Malware payload (XWorm)", "value": "2aad641684513ec4f84e64fdd50cea7694539f50f16c68c1046d8bddcb1b9e93", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115808, "uuid": "4455f846-93ca-4e69-8f5d-474443807d29", "comment": "Malware payload (XWorm)", "value": "3df67dc85d4090c9a0ee46b2d6aa997b7efa3718", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761115808, "uuid": "b917f051-cdde-45cd-a41e-208b95e4b218", "comment": "Malware payload (XWorm)", "value": "a6b87620fa802f08db519a03a949d3dbed73a5878e571e9b19502f05dfbe41d2c9ffe56c503fad3fcce862b70959e13c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115808, "uuid": "cca4280c-acbd-41fb-ae28-e0dbe5f95dde", "value": "T180A5AEB28CB75DCA2F7825CAC5CE7AC43F1C57538528A6906E4FB27F21585017ED88AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115808, "uuid": "9318ef6a-762b-4ebb-9056-9bac0eadd40d", "value": "24576:GV82FDiQjJBZo4o8aek23cn6NwhP9ekJE2vHd7YBkgFbiKR664NYDQUgtce:b2FDFo4o33+cZugHUcYDQUgtce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761115808, "uuid": "e35da13d-309a-4dad-b135-10bb66621d8c", "value": 2240187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761115808, "uuid": "92c42e26-6967-4d2d-b7d4-cd6141cc95ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761115808, "uuid": "cfbaf3ff-69b0-4472-ab27-1449892d0f50", "value": "IMG-2025010-WA001310.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc844b66-af38-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761131920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131920, "uuid": "7e34bc03-9631-41d3-88ba-1d48440c579d", "comment": "Malware payload", "value": "4030d38442c66bd5a704603e519a2156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131920, "uuid": "d3d1a7da-c5ef-40cf-b192-4003b5c2973b", "comment": "Malware payload", "value": "2bb13614d5fcc31e54ef6ccde009516c8fc12a6f02bed18048bdae9359fa6e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131920, "uuid": "62092e9b-89a8-4771-b4af-1d6b79c3b4bf", "comment": "Malware payload", "value": "2e4b922e1ac741639f94429b5d23c60df245a4e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131920, "uuid": "be8d15c0-d99b-4241-8d26-bef9e6aab0d7", "comment": "Malware payload", "value": "58657d33a9ec698a8cfd0802ef3fab078d6cad12c1716d6ce0850886379d27580e2b1fd851a256928015a03ccd174ab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131920, "uuid": "63aa53f8-24b9-417b-ac60-a46d57803e90", "value": "T189D2E0D2D177072EF4A3D6A81BD1D584728B022F7005E5AF4348D4F9A5F869A0F28F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131920, "uuid": "376fbe23-2c5a-45b0-ad8e-00c8c1254003", "value": "768:m3Lq+sg6rgzQ8BOMIAzVQR7iaQUGFqcKGET5aeDlz:m3LqE6rUQWzVQR7iAGEcUT5Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131920, "uuid": "226cb11b-5352-4814-9300-63128d4f12e8", "value": 29820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131920, "uuid": "2c930862-255e-4a1b-b17e-e419c990855d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131920, "uuid": "e9f93fe6-233f-4aab-9b87-b2e8302f7ef4", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343f5975-af9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173728, "uuid": "a7a4bb07-8a7e-43c1-9f09-a88c318455b2", "comment": "Malware payload (Mirai)", "value": "df59db443e8c1a46d0fdd9566e41bbd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173728, "uuid": "3184d21a-29d6-4a6a-83e3-4148cf9e8b7b", "comment": "Malware payload (Mirai)", "value": "2c52546385a8008aa99c4449b75e721496de8455f64b7aad626a11be6b4e77ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173728, "uuid": "e0df775f-664c-4464-b8e6-b610c704c519", "comment": "Malware payload (Mirai)", "value": "e9e31ae6ec8efe104e2e1612b6815b06ad58bbac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173728, "uuid": "740acc3f-19e0-42cb-bb6f-d836cddfbee0", "comment": "Malware payload (Mirai)", "value": "8faaff6e72ec0a1ab77eed6003a7f26e438dd894fc415d134f84d2c788cbbde1935d87c3b912538338761fa5b0fd7f5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173728, "uuid": "bfee5c3c-2836-48c9-98a5-793662b41866", "value": "T1BFA3851A6E119F7CFB5A423487B78F219A5837DB2ED2D045D19CEA411E7038E301BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173728, "uuid": "b13969c5-40af-4e6a-9b6d-aa1ea83e0ca0", "value": "1536:H5HbkruSk88Z2D/R870H3HReVh99gLe5+vHRJvTVGetxdhQzhmI:Z7muSC27AcRAILe5+vHRJvT4AxdhQzh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173728, "uuid": "22c00b44-6da0-47dc-9114-d49c42f2ec1b", "value": 107032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173728, "uuid": "06a2b6c1-1244-4d7a-8bcb-85abba82850b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173728, "uuid": "e81079ad-bb8a-4e95-a357-a22198cfa83e", "value": "kwari.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17641e4-af6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761155067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155067, "uuid": "77c8a4f0-8a06-489c-a6fd-7e7deaf94089", "comment": "Malware payload (Mirai)", "value": "69ec2cfca2461f68aefa86a7471c0456", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155067, "uuid": "5e700e78-55a8-42b5-bd58-715b393c74d3", "comment": "Malware payload (Mirai)", "value": "2ced535279544792ca0aa3d3e0d5a97b269ee71b51d421f4adeda26f6c47c4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155067, "uuid": "81b14736-26b0-462e-9766-a6cefd22d3b3", "comment": "Malware payload (Mirai)", "value": "56f5d3aba85c6ad59387aa1ea81e26edbf9009a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761155067, "uuid": "67e094e8-31a7-4b75-bc40-cabb7d410a2e", "comment": "Malware payload (Mirai)", "value": "10cb70ff6a2b65b605cd555ac85aaf1cb8817b0b52ecb66f339c5ee6af656b75286a4089bf665423e472241810dd33d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155067, "uuid": "2c001eb5-fcb6-4ee3-98bb-6f8be90431a0", "value": "T13CC32946A9419F16D5C622FAFAAF418933136FB9D3EA7101DD206F5023CA9DB0F73612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155067, "uuid": "2b1023e8-0fe8-46da-be25-0e0f7e323a1f", "value": "3072:XkAc7kfEUpcVt4V4puu7Vl5aTpcFvyZSrlSmIIWYtWtbO:XkAskfEUC0Wpu8j5atcFvyZEl0I9tWtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761155067, "uuid": "28945742-bdad-4544-9941-edfa0e77b983", "value": 124288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761155067, "uuid": "2ef99b34-40a7-4378-a2e6-4ec566075385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761155067, "uuid": "a5e76812-fb04-4b9f-8627-bc11d811e75e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22d28ea-af91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170181, "uuid": "1f7d3644-9bc4-4f4f-8676-46732474ed69", "comment": "Malware payload (Mirai)", "value": "30f5710edbcd95239cc20eb0566a4f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170181, "uuid": "3558b2a2-2c9b-4a59-83c6-eb5a11f32c9b", "comment": "Malware payload (Mirai)", "value": "2dfd6033e90142d39c0da68aa7c029a0fd80cb2d4974574399d5c605d1347dfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170181, "uuid": "fa7c4bcc-9d43-47a3-8aa5-2099e03b6111", "comment": "Malware payload (Mirai)", "value": "6499bcb5a0077a82ef115d70de3591f7d186a3d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170181, "uuid": "c0aa4756-2c01-47ef-acb8-d821bffe09f2", "comment": "Malware payload (Mirai)", "value": "c70fc617f33bc0b306db18d8b714aa56287e1b7db9e0e873218b98ddd6e84b56e4ae0650771e8ed96444d970082c8b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170181, "uuid": "f67c19ab-d73f-4c62-8efa-be0fcfb8e09d", "value": "T1D534B60A6B519EF7D86FCD3705F5870125CCB45722A83B3B7674C62DB91AA0B09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170181, "uuid": "6be49603-e815-4178-b3cc-7a1c5b358d3e", "value": "3072:4vvnl8j9FbewRmk8e6rp0KiUVXktAGQIhyc:4vvnWpFbewRke6p0giYIhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170181, "uuid": "d1f34cb2-59ad-4af4-885f-f5f72f85b946", "value": 241008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170181, "uuid": "44cc51e8-f1c2-4746-b117-dee2b98c5aef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170181, "uuid": "32389c25-1abd-478f-ad24-6f2804b72ca7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaf68a6-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761114045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114045, "uuid": "70c90c80-32c8-47d0-9c01-552f230ea57a", "comment": "Malware payload (Mirai)", "value": "c5c2309326be1d31a07a827a21777c30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114045, "uuid": "077f6b88-a264-47e3-a6c3-6c57ad8d3b15", "comment": "Malware payload (Mirai)", "value": "2e885684d4d5f2e86f6ae144938a6f27071975dc3b31d4fe15267b5a67355a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114045, "uuid": "d5d5cbe2-de87-4f08-8608-4af1ff0407cd", "comment": "Malware payload (Mirai)", "value": "b2a65040f5fa3ac2a11485422e562df6c706ae4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114045, "uuid": "f608fdec-23f7-43de-963a-057df154a171", "comment": "Malware payload (Mirai)", "value": "8b66fe714bca6e1fc93c859a8ec7fb0c5309eb3c6dcb493ef5d3bde76ebe5e491d34281f0906222d2ccc80fee04d78a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114045, "uuid": "61413333-33d5-42de-98e7-1c7e3060a448", "value": "T13834B60E6E229F7DF768873447B38E24975D23D627E1D684D1ACD2101F2069E642FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114045, "uuid": "55ed76fa-2c8a-42db-87fd-3c8f45bcdaba", "value": "3072:UXy1h6c3KWQR40Bud45aD/6CGuhv4moW0Sp8bXXT8ghs75:51Ac3pM40Bud4k/DJ4ipEXTBhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114045, "uuid": "e17bf9c8-1cfd-4b81-a215-3130c57d485f", "value": 235424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114045, "uuid": "717975a5-4227-450a-8181-cad0d06129db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114045, "uuid": "665d1180-b763-48a9-843f-5d61d9dea3f6", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f95e60f-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150662, "uuid": "d98056d4-032f-41fe-b036-7b8e3ab02d42", "comment": "Malware payload (Rhadamanthys)", "value": "14403ec21ebbc29fc40765baf76f26b1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150662, "uuid": "b7c2bc14-0447-4a3a-8ef1-48d7249f0091", "comment": "Malware payload (Rhadamanthys)", "value": "302043055c435e4428bfc819f1984919964475402b0b7ee3fdb9769cbf81b9f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150662, "uuid": "ea1d9297-1147-4cb4-8903-13be8a484363", "comment": "Malware payload (Rhadamanthys)", "value": "50cbc1eb7588ffb8e7654e815c981e22bef4d1e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150662, "uuid": "96187b74-89f9-4354-8953-410afbc6e11e", "comment": "Malware payload (Rhadamanthys)", "value": "4ac731041ce8ddcc92fddd32dbdf647edd2c402c8ac8944d0ecedb29636a9850d20fdf68b88d9e4d537eb9c688f9fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150662, "uuid": "d0183b85-6681-4ded-bd7f-7f81dc3de385", "value": "T10DA339442C3277A914F253127F0E84D7342C9A8A49BE1671599FBFB5A19AF81CC093FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150662, "uuid": "52928d66-37cc-47f5-98e6-836b4cbf6fb4", "value": "3072:GDB7b00ie7bYeCURUO4+Ent7beMiNPo42tJtpHqF7lDx7J0SJVK6Qx3qkRqU7Wy8:0vie7bYeCURUO4+Ent7beMiNPo42tJty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150662, "uuid": "d50fd393-abd0-4703-bf7b-b120f46cbf7f", "value": 103337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150662, "uuid": "8417309d-ad08-4642-934f-cd549dd2178f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150662, "uuid": "828064ba-8ad9-4661-9baa-078034189b9b", "value": "invoice-1637482117.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd457f4e-af9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173958, "uuid": "68f59ad9-a49e-4a6f-af5f-6aaadd696c01", "comment": "Malware payload (Mirai)", "value": "654fabe26e5281ea93e708b045e6e47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173958, "uuid": "30f2b630-082e-462a-9457-63744914be2d", "comment": "Malware payload (Mirai)", "value": "3162eb72429e23c816ca7405e907091a8193c878ba1bd1751c503873a60e18e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173958, "uuid": "9e896481-e2f7-46d1-9a33-6a85caf9d0f9", "comment": "Malware payload (Mirai)", "value": "73274c2badc663f20cbff1bcc3aee42fd3de1105", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173958, "uuid": "620bdef8-383b-4e5e-bf3b-4433998441f0", "comment": "Malware payload (Mirai)", "value": "f095443384bb2e01b2521396dd83ea68e457bd53794929fcc9d3fb9d681c125aa67590119e1e139792f5610fb1ef4dc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173958, "uuid": "46f7a5c6-18f8-4800-87f5-6e3428f60be1", "value": "T1E753021A801E5FD499D916BBF5DF6E87D804344832E592F39AB64B1E0703F9F2B0CA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173958, "uuid": "5170ad88-78fa-44a1-b515-fe1e5ec65bbd", "value": "1536:YCCq0p+J07WvtO8Fykq09dZiGFL6zxaynouy8HyO:Ri+JOWvtO8Yk19dZzFL61VoutV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173958, "uuid": "de210ad3-4dcb-474e-82b2-273274ac28a8", "value": 65584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173958, "uuid": "000ea6f0-9fcc-4a07-80d3-5144f16b6c25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173958, "uuid": "f4eb72fb-d25d-4d90-9a83-5a6f336ec696", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f267f9-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134975, "uuid": "2eef0f3c-5af5-43f7-ad4a-cd51f7ab4c60", "comment": "Malware payload (RemcosRAT)", "value": "fb082a574c97c7d70601f2fead460ac1", "object_relation": "md5", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134975, "uuid": "922474a6-eaca-422e-b081-ef4f6587651b", "comment": "Malware payload (RemcosRAT)", "value": "3354fa146ad6627fca6c1cfc730fa9b003f829576a280881bf2add8725dbecad", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134975, "uuid": "8600bfd6-9396-49e4-903f-f79da9a8eeba", "comment": "Malware payload (RemcosRAT)", "value": "142f3b236485d9c52d49a70a11837dc3786d85f2", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134975, "uuid": "3c05e3d4-3c19-402d-a38b-3d658c71e3d8", "comment": "Malware payload (RemcosRAT)", "value": "f098d007453fdb6700b91acaff00d5abbaea6e617efb7a4402a5a3b7495e4f2f6de4946a4c592dcd627bbdd5af5193e4", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134975, "uuid": "1eaf2f77-14c4-4365-a8f6-f96b1a8f13bb", "value": "T1BB8501A31E14DC8937C9A9297EAC7550E2E4EE773DB7A5210293EBEE27369410710F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134975, "uuid": "df3766a8-c39f-44e6-bd31-1eadf4f90e4d", "value": "24576:5iI7vlWFjtmgMHfVfRe5dn3acpVGQAqcH/VU9jgE8syvPcPV1WCpkU:DwaXEcH/VU48WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134975, "uuid": "d1bd2940-c171-4cf9-9252-43ebc8d7ad3a", "value": 1844017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134975, "uuid": "b3b4017e-31d6-4317-8cb3-505f5654d8e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134975, "uuid": "c9cee83e-ca16-466f-83ae-575a7ddea958", "value": "Komercijalna.Banka.kopija.za.plakanje.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bfe5f5-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761113438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113438, "uuid": "9ef31d03-2b40-446e-a92b-67544893a3d3", "comment": "Malware payload (RedLineStealer)", "value": "c27479771b6aadc131931cf540b83899", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113438, "uuid": "1b026efb-2696-455d-b221-f49b78f86167", "comment": "Malware payload (RedLineStealer)", "value": "337c03a03f4ec1e83772ddd2b55934786f2de8f4927aeab583cb2ed0b3fb64b9", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113438, "uuid": "05a1e740-ec50-474a-96a0-388a6a5a972d", "comment": "Malware payload (RedLineStealer)", "value": "1adb71922b9be50df1d574e571484d9bda9aea98", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113438, "uuid": "18276244-4d17-4d8d-b774-c48fb67c0812", "comment": "Malware payload (RedLineStealer)", "value": "2b6f0a317aed2fc7f9bc59f333ceddfd035e09e26f965a90c67ea4818af02401740c12aad4ed84e7704f9a76b9c62855", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113438, "uuid": "4c3c8288-8e14-4427-839b-7339f58c3829", "value": "T1C855231034C1D0BBD1BB253194E5CA7A4A2B307507B545E7BBDC2BBA6F263E193362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113438, "uuid": "2a8083db-d05e-4df9-8b7e-75ef8647771a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113438, "uuid": "42b544dc-9f98-459b-8aef-5330bf12c2cb", "value": "24576:Ok70TrcBuoy6mDB+XnTT6/gGBcIzg8Hr4IqMI1fQPqgJ/SaaB0yPf6t6wHFPD:OkQTAny6egT+YEPzCIqMItg9y0yPf6tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113438, "uuid": "c2bc4b8e-972e-46ca-bc31-4a23b1816855", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113438, "uuid": "ab620be5-47ea-49d3-b203-16275f49a3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113438, "uuid": "5812de02-5045-43f6-bfa5-af4f5f095d66", "value": "337c03a03f4ec1e83772ddd2b55934786f2de8f4927aeab583cb2ed0b3fb64b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dd4a50-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761131080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131080, "uuid": "14a4597d-4930-4002-b000-fbe73bc6411d", "comment": "Malware payload (Mirai)", "value": "6ad81578f727408a3483967c78817db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131080, "uuid": "bd8e6af8-820c-4bd4-b719-10a1fbb6a43c", "comment": "Malware payload (Mirai)", "value": "33f7db07179b05d520211cafae2d13f8fb097066ef2bfc18ed501733a3b361c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131080, "uuid": "d21c8405-d452-4cb5-b68d-2024fc6bd694", "comment": "Malware payload (Mirai)", "value": "11cc82193e1c6665e4643533bb1cea0fd75a93d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131080, "uuid": "33b92a81-5be5-4a24-864a-5b564a14ffed", "comment": "Malware payload (Mirai)", "value": "ffb1b1de0be36940d0ba85226eaf70d7927c6b229410496be312075debe1a0572b47cb2de85fb0e91ff60402d7547f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131080, "uuid": "24cd5223-a998-4d01-b6ab-d39abf78a9e5", "value": "T19163D759BF610FB7E8AFCC3705A91B4228CC955B22A53F35B970D418B64B24F19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131080, "uuid": "3c511bf0-0567-4f96-87ef-c89ac231951c", "value": "1536:FDTxZkvE7xEospt7G3TX7/0LH0Zm0Fmaxb+10WC+:FHxZkvRptpr0txej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131080, "uuid": "59e23f22-9f18-4d0c-afe1-121181fc9438", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131080, "uuid": "91478030-cb49-4095-b98b-a169c98f650e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131080, "uuid": "803fd08e-45dc-4c1e-9daf-690712d7f626", "value": "botx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f07eb45-af9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761175169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175169, "uuid": "64207f40-e87b-4adb-89d9-5a7a01cdd987", "comment": "Malware payload (Mirai)", "value": "06bade168a84dfc1a62b47e4ae71b965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175169, "uuid": "7e957a1e-e538-45ae-a608-4a8ea0552a0f", "comment": "Malware payload (Mirai)", "value": "3430f9fd6e6ee30757f3270216d5e966b2664e3dc6811959d8062809c204d85f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175169, "uuid": "027886a8-0934-4585-9f3a-b2abd320d606", "comment": "Malware payload (Mirai)", "value": "d4be9ea4ba5fe17b1f76ab0988d3ff5e2f55112d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175169, "uuid": "b35b71ad-f4ff-4f0d-97c9-31b5bc8f630c", "comment": "Malware payload (Mirai)", "value": "9e39e5579ec7f0fec409321b9ddc908b89e9adc46264fa262d665a256f79f1cd159798cb9bc44ddf33252e09fc3eee43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175169, "uuid": "5d9fa892-5ebe-4bfb-a984-83b651a9f43e", "value": "T1D783290336184F13D56309F0253F1BA087AAE9E629E5B685A55FDFA14B31EB71086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175169, "uuid": "8955e44d-ecc5-49d2-a2d5-31fd6e7717a0", "value": "768:vOMhlbxZyYVFn/3SRWJtvp8t651tOHER+XmzKdMKr6iH3mnJ64nH383BrJOJnldy:9ZH3SaGceA+GNM3BrsJldhQzEIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761175169, "uuid": "5586d796-0f08-491e-8353-7222f1fe5b99", "value": 80924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761175169, "uuid": "4be7560a-5d13-44ce-ae27-1d871c640398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175169, "uuid": "75f61a1e-5330-472b-869e-35977b5952e7", "value": "kwari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5be091-af18-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761118206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118206, "uuid": "6e6649bf-a66e-479c-8a0f-720ea1de5008", "comment": "Malware payload (ValleyRAT)", "value": "136dc0f416cee57a49dcd360b116078d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118206, "uuid": "10010787-d513-4dea-aefb-9a9a562709c1", "comment": "Malware payload (ValleyRAT)", "value": "347b5474c93b1bba28e78ddebd3387b88ebb4355188e877576cd3575193b31e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118206, "uuid": "08f4eb73-d2ee-4b2e-9e13-427d05b84df3", "comment": "Malware payload (ValleyRAT)", "value": "0ebb0e90a21afa4a4cc9a151e977dd0ebf96c8d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118206, "uuid": "15a165b2-9793-4d45-92dc-3a4cd3b1c8e4", "comment": "Malware payload (ValleyRAT)", "value": "7f395b89e89b1f9512c980b62beb811e3ecc236bd953f55aec621c573208a1e49f673121f912eaef462b45ae9efb64ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118206, "uuid": "393f2a1f-910a-4fba-8f5e-ee4768247c68", "value": "T164B37B2172A0C072C093253199F9EBB25E7EF93117B844CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118206, "uuid": "fa5a97e8-445b-495d-876e-952142cdf54f", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118206, "uuid": "ae07bf64-d687-4c2b-acfa-4b9bb64b9124", "value": "3072:AbWjdIPbcia0NFtwwnILn3py6D268XEPKK2:AbWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761118206, "uuid": "d3faa238-74cb-429c-b2fa-b7f84c2c0d7f", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761118206, "uuid": "383d1e57-95dc-4acd-8428-1c1825bff24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118206, "uuid": "29ccc510-ed09-4740-9811-5dc8424469e3", "value": "136dc0f416cee57a49dcd360b116078d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050fcfb-af10-11f0-91c6-42010a9c0006", "comment": "Malware payload (SVCStealer)", "timestamp": 1761114370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114370, "uuid": "29e6ddf4-6c4c-4608-b09e-7f69f25a5eb6", "comment": "Malware payload (SVCStealer)", "value": "7d7c3c4cc4fcf8fd25db10265d8c7f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114370, "uuid": "25f969aa-fbce-4725-b348-40ff6532ebcf", "comment": "Malware payload (SVCStealer)", "value": "34916f068c8e1bd60b49c89051178b88e322967669975683bcaf7b635f0a058a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114370, "uuid": "b1ba6e86-32e4-4c3c-b1e7-be1a6ae822fd", "comment": "Malware payload (SVCStealer)", "value": "75c3d252ddb34123cce9fc7e3ae487848c0f5e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114370, "uuid": "44fc1aa1-0a5b-4442-9adb-b6554935dfbc", "comment": "Malware payload (SVCStealer)", "value": "b68336b5d0970c980c1780d9c8da332d8d460467af1c1956a3b2bbea536c7d69a13cf1724fed2b399cbde5971fa0b126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114370, "uuid": "6d2b0b38-2f43-43f2-9b05-948de9f7a95b", "value": "T1B5A4D00A775440B8E8AB913CCAA39A46F6F23455077093CF13A487BD5F2B7E15A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114370, "uuid": "b1f8424d-256b-41ad-b636-29b2f50a21fe", "value": "34af6d04432bc370a0e70469b3cf516c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114370, "uuid": "884770bb-c6ff-4db6-a778-0724f13145d2", "value": "6144:nCxx7no9uhpTVKZD7TIOfNIRWt+nlH12fKSV5TqOFzHF5XaE7lXC18N+Fmrady91:CxxLxClIWt+lH1jSV5HvqeguN+pK1IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114370, "uuid": "582f1fdd-d10c-4a4e-8d51-67cfb7c19e7c", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114370, "uuid": "45f8beb3-bdb0-4579-8168-1483d96484d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114370, "uuid": "69310a96-2139-4cce-b99a-6d951997a002", "value": "SecuriteInfo.com.Trojan.Inject6.8927.3067.25774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1910ff-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761154580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154580, "uuid": "33fd97e8-ed9c-4ae1-8720-e2b766f74923", "comment": "Malware payload (PureLogsStealer)", "value": "0d59e3136a60b5523e6a195e1ae2b551", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154580, "uuid": "615ee04c-75e9-4382-8c30-ba5c1a8d7862", "comment": "Malware payload (PureLogsStealer)", "value": "34be726f4124bc62e7dacdfc48546275856dc4d9870393cad84f5798b807a8fb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154580, "uuid": "139f839a-f18e-4204-98be-b506c2e2d495", "comment": "Malware payload (PureLogsStealer)", "value": "754a3608a1a3682047aeeb52ae56b0222905050e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154580, "uuid": "a8e8f8e2-9b4f-4d04-992a-37e783db251f", "comment": "Malware payload (PureLogsStealer)", "value": "88816f5b6962dc1cd4533790b2aeb998524e7eea44b9857d4ef0afc5a96e8a193af07d3f7a04a7243257f076d286d34b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154580, "uuid": "b000b1aa-c8f3-459a-8d89-7d187ccebf10", "value": "T1C47533049F5A3CAA0B785B1A913F770C17724FD24B05D9FE86E0A4E6027BF405A679BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154580, "uuid": "5edf2d6a-f958-42a7-b731-fc3781054821", "value": "24576:OBxX2VsF82wlpVxwu11hxYA/5eF4ctseh45dIITirUu+IaOvIBf5yXxYYFnf:ejKL/wnh4s3rXMYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154580, "uuid": "05915aae-1c28-4588-a22b-dc9629d9a667", "value": 1550939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154580, "uuid": "f6e26d82-0c82-44b5-a334-b1045c9f0d52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154580, "uuid": "a6e86a36-b897-438f-bdce-73c85f002580", "value": "pp_1c_22_10_2025_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61527b96-af68-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761152329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152329, "uuid": "5b21c2b9-7c33-4530-b35c-d3be82805ee1", "comment": "Malware payload (Mirai)", "value": "6ffef00bdc77b270953b246e77f66cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152329, "uuid": "a6bc255a-1b0c-43e3-bc41-438a79cc6a6a", "comment": "Malware payload (Mirai)", "value": "3864cf52dd47a4950dee861b28a57a3c7736d1cb12ec351fc10d5359def95fe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152329, "uuid": "24f9a207-3669-4d7a-9cdb-dc70d28b27c0", "comment": "Malware payload (Mirai)", "value": "ab1779e66b8ed6217f40b1a890bc551965ba9201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152329, "uuid": "7f98687b-e404-4e67-a5a6-847b6b818e80", "comment": "Malware payload (Mirai)", "value": "f76501bec0d271e49ca15629a136d6d61990842b97d889790020b38759989a7c4754eba34de8c111c384f3e1face84da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152329, "uuid": "6c556afe-dd15-49d5-959f-04ef7139b8ba", "value": "T1F6C31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152329, "uuid": "2a94c477-b4c3-43d5-8ddc-399604b25bd8", "value": "1536:JCDwI4fG50nVg/QDEC9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDF019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761152329, "uuid": "4001e31a-9e6e-4da8-a76d-5ec35a1dd430", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761152329, "uuid": "56aa4308-e911-4916-bf23-211b474b65d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152329, "uuid": "f73a8e83-03df-4eca-970f-c6f8fc04318c", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7433825e-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135610, "uuid": "2a9b0e60-fd61-4fd4-8f03-00fe49e58dea", "comment": "Malware payload", "value": "eb0a33931e463d32ad79b008354405e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135610, "uuid": "d2d72afc-3c2c-4cd9-9ba2-195a0cf0825c", "comment": "Malware payload", "value": "390c426cdf72339ac88279d781efe88af5e9c95e6e79f9da78e02a02cfd4fef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135610, "uuid": "d1a6399e-bbe5-4bc5-8568-023fd7515cc2", "comment": "Malware payload", "value": "224bc8ffea8bb2e225f00b546fb49b16cbd848ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135610, "uuid": "148be8d8-0d0a-4b51-b31d-3555b7502e4c", "comment": "Malware payload", "value": "12176e3c2a1177ac1016ea1594f85abde5fd76d63ee0cb45b832f26fa0a670dbf48ab5348d8a2f268ac3c9de687196dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135610, "uuid": "737ed57b-03a7-4956-bb3f-56a491001eb1", "value": "T1D076BEA9BA7D00D5D46AC1BDC2865227E772B41547F057CF2A648AF60F23AE01FBB740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135610, "uuid": "fafe9f1e-6714-49eb-8277-317b96b437e7", "value": "c54abf6c8d259743801e2743fc02782c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135610, "uuid": "026c9a6e-e359-49cf-9d40-37e3e7d42a7c", "value": "98304:rBpnXPzMjZzXpmhspXVKoAvTj8MXyiDjD+Q3oHUNeqnaq:rBpnXPzMjZzXpoyEoAvTj8MiAD94fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135610, "uuid": "ae4a56f0-5035-454f-abee-3eb65c006cce", "value": 7157248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135610, "uuid": "3065ba7b-d61b-4a1d-bf1b-230c955d75bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135610, "uuid": "72cc59e9-d2cf-4afc-96e5-41d768d0e369", "value": "eb0a33931e463d32ad79b008354405e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea74e76-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (OrcusRAT)", "timestamp": 1761113401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113401, "uuid": "f7f111a2-fcc6-4046-8ca3-2d527c55c243", "comment": "Malware payload (OrcusRAT)", "value": "5f00f9b962eb8743bd6dac2b2fe9cc74", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113401, "uuid": "33a47c21-a7b9-4d12-bcad-7eac0d99cbd0", "comment": "Malware payload (OrcusRAT)", "value": "39fb94ab58c728558135d89bf61a7a38ca50a116643f63cbe0221b99cf51b925", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113401, "uuid": "9c1aaebe-6f82-42c7-9cce-0b1a0fd1b5c1", "comment": "Malware payload (OrcusRAT)", "value": "5f8439b3b34b8cf14ec682294c2b09503610e871", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113401, "uuid": "abb88574-f463-4448-b593-9246dd166541", "comment": "Malware payload (OrcusRAT)", "value": "91170220a91805df02ae932a82265fb57ac345a26feef6afd930b40f365c4380cd0dae57636d512965941d8cd9ce7d2c", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113401, "uuid": "801889ba-0abb-42d6-b64b-091921f3fe93", "value": "T1E925BE3F0EBEBCC5C9A72B7180B5870A7BF1B57B9324171B22951E515E1E052B8722F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113401, "uuid": "932bd4b8-8923-4432-aac8-8b94ba12b8b8", "value": "3f6c71eacd74a3e4ac9ee279bef42d3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113401, "uuid": "41a1ee27-6ebc-48ce-957d-4bbe17220b54", "value": "12288:0VPZLizvSlvddPAxkGfVfMyg2hqETy0+4xFW3kKJZ0C94wnYx32YEIWj0YvqnM:0VPZLigd6Tf1hqWy+xFWLf19MkfDQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113401, "uuid": "6d3ec5d6-9594-4c0e-99c2-25a4bbe1d4df", "value": 1002069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113401, "uuid": "96c5c3ad-27d6-4307-9208-d74e5b76980d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113401, "uuid": "89ef13fc-bd1a-4919-9db8-34d341a80dd1", "value": "39fb94ab58c728558135d89bf61a7a38ca50a116643f63cbe0221b99cf51b925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c058a3-af02-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761108692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108692, "uuid": "020cdcf2-bc38-4ff7-912f-e3888473e772", "comment": "Malware payload (Mirai)", "value": "b9d832eee44b3a1c94cb75fca7d7210d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108692, "uuid": "f5fa6ce7-5fc4-49a3-a455-1e6257f6c8af", "comment": "Malware payload (Mirai)", "value": "3a4c4195aa3623de12f21295c2a2c3630e4de55a0eb92bd6334970ece0622558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108692, "uuid": "a852fd0c-71d9-42e2-8c37-2514e20e6a71", "comment": "Malware payload (Mirai)", "value": "5cce3cf23d86da6e4aa5978ba58008d729a197f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761108692, "uuid": "2e6e4d12-3804-463d-8a1a-e9b1ac5e5c9c", "comment": "Malware payload (Mirai)", "value": "fd3e8d31dcdec57d0e5a3a1cafca3297e0e77a929fc84d8c36dc4f7bb4000985628491595409750760e25fe318134102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108692, "uuid": "b8db8374-8c6d-4add-b886-6159ea590942", "value": "T109A30A16FD818F11D4D522BAFA6E018D33526BF9E3EB7112DC205F60378699B0E73A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108692, "uuid": "490d0abd-94b0-40bb-8f8e-ce360bfeafb7", "value": "3072:hY+0Fdns8yQKNJBohZeoZ8UfxdhQz2vf:X0Fds8SNJBohZh8odE2vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761108692, "uuid": "69a183d6-9c06-494b-a2ae-291099f844a8", "value": 101076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761108692, "uuid": "fcb83589-e206-4221-bf07-7d0864677df8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761108692, "uuid": "b9422257-1646-4c75-8ff4-78b559b655e7", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5299182-af69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761152979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152979, "uuid": "72b3b173-1e95-4485-97b2-489ec6b74c7a", "comment": "Malware payload (Mirai)", "value": "fa5d7438a59f4f1369c9373856d54ffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152979, "uuid": "0b2288e3-1b8d-4112-9437-0833e7dd4e41", "comment": "Malware payload (Mirai)", "value": "3a560b9403010fe8be27a41630b8407a31046c9094339fe394e42a70fc05900d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152979, "uuid": "a680466e-a783-4f77-a6f6-9f671d02ec3b", "comment": "Malware payload (Mirai)", "value": "c1ae86d8ea057699fc0f892aa3f67ae4487a4b2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152979, "uuid": "49f4b615-b982-43ea-b4e1-e0a49db10331", "comment": "Malware payload (Mirai)", "value": "013b51d698b96dcfd69b3fa2ef5ccbe7e606efc3c86bc83e8e9773186b5571b7a7651f601c00bc3f7f9b802b65cf9d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152979, "uuid": "cd471d47-32c2-4c35-99fc-e7802bb11dae", "value": "T185D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152979, "uuid": "f1a4a08d-9473-42e0-9a09-c018c1785582", "value": "1536:cP0nwryWv+n/qZIdcST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+DcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761152979, "uuid": "7d114051-1ba9-4cbd-8018-bc3be57cf6f8", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761152979, "uuid": "864b8547-3a24-4aac-a1ba-c1a58836a10d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152979, "uuid": "516cbf8e-76bc-458e-b2d6-b5803eee5100", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75357ce-af3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761134515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134515, "uuid": "e0333604-5e18-4bd8-b511-aff3ca41e111", "comment": "Malware payload (Stealc)", "value": "451c56ae348e1a7dbf74d8b866f06273", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134515, "uuid": "a5339b36-2667-4fcb-854e-f43caf053a2a", "comment": "Malware payload (Stealc)", "value": "3a631b401a7730521459f6f40b7470a9ca055aedef3f86ee526be2eb4415c513", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134515, "uuid": "0864697a-0f27-41f9-b309-c76b0099adad", "comment": "Malware payload (Stealc)", "value": "167ee662872f888bb8cda3e4b0a383c778fd09bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134515, "uuid": "03306d88-fd6e-4cd6-aaf4-695913067a70", "comment": "Malware payload (Stealc)", "value": "e5b16e2434935dd55dd747bc415af3eea45aeba0bc8df5d384f8e525a3bf1e412dd2736b83657ec9f13aac41a1c0b677", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134515, "uuid": "61073280-8343-4734-ae5c-ecb311b951e3", "value": "T1A456AE15A3E800A5E96BD734CA52C333DAB0BC965735D10F0998E2462F73EA28B7F715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134515, "uuid": "e827f5a0-72ab-4285-b147-a3c57940a854", "value": "4ce7e54338a7a66f77b5e79e564d9aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134515, "uuid": "0d8032cc-88c9-4ce6-b04d-4c0e70577097", "value": "98304:skvSZ7XkvhH92jQDgZcsAPaLbNEV7oqR:sSS9+dinAP4xynR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134515, "uuid": "c96f14bb-509e-4507-84b1-2fceb5b1341b", "value": 6388736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134515, "uuid": "b3f641a8-1592-4f69-853b-db661fdfd587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134515, "uuid": "22b3b09b-4655-4941-8761-02044d8614b3", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0918c3-af08-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761111360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111360, "uuid": "16aa9740-dba4-4805-801c-5909fb08f772", "comment": "Malware payload (Mirai)", "value": "99387b26db25bae21e0f082441ad73c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111360, "uuid": "ebee832f-f69f-4ace-9e14-a1433e8028dc", "comment": "Malware payload (Mirai)", "value": "3b15df1384e71b701513cbc8eebce1950c67966a40bd9d4920895244a39ffbf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111360, "uuid": "8ad4a7bf-d327-4e1f-99fd-b9e509f48c0b", "comment": "Malware payload (Mirai)", "value": "02b4bc149aa261110ffe0f7296bd665baada7010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111360, "uuid": "2b383e33-36a5-4de9-9352-606375a8fc04", "comment": "Malware payload (Mirai)", "value": "87c28d7e6aec9f11202b1f9ec530a543b514655184c84bb610c51e66c9eab6fa2ffb07ea0a65838ac9531ec213168c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111360, "uuid": "76ed85dd-cfc3-467f-a16b-4f5793b29d43", "value": "T11BD30855BC81AB20D6C615BBFE4F118A33135BACE3EE7213DD145F2427CA94B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111360, "uuid": "ab3f5673-e4ac-491f-8ea1-322a52f69ca0", "value": "3072:1M9qyd0ktSGePKzlf3Wp+rVBQhyL5qa0cu+rVpD1B+4hDgLh1QnzP:1M0Q0ktSGePKzlvWp+XQhyFqa0cu+rVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111360, "uuid": "80a0d0e9-7af5-4529-8849-d61ebc07a1d6", "value": 132592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111360, "uuid": "046bf5b6-b9e4-444f-8039-3ee08739f16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111360, "uuid": "ec499dbc-ab13-4dcc-9e22-e2c658a6ab6b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80a5d4c-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134919, "uuid": "388eba47-cde0-4623-8040-e0c28c07beed", "comment": "Malware payload (RemcosRAT)", "value": "744939195531cadb69e84fe94aae9eec", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134919, "uuid": "a2ce0f11-f996-4c7b-8365-ad7b741b00dc", "comment": "Malware payload (RemcosRAT)", "value": "3c4850bad9e48453996875f76725ab4caf188613ec4621fef7fbca2fd19c2147", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134919, "uuid": "bb45a24a-bd0b-4a4b-bd1b-3fc29e1893e3", "comment": "Malware payload (RemcosRAT)", "value": "8472cfd70946968575dcbc9c42c6b6e2fa4e25e7", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134919, "uuid": "3962e574-4220-4442-b159-8c3ac6ee44e2", "comment": "Malware payload (RemcosRAT)", "value": "0dea46bd74287fe10a34c213e6238e3bd6cdd50710359494c0645224a0cbd10fa5fdac87a6a1aab4a075eff4eac4b91a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134919, "uuid": "9335a5b6-47a6-4ade-83d2-62fd4ee22459", "value": "T1B305F13E9AA8DDC7CFEE7DFE50A61A400254867389F03A688C4C57DB1A1B24FD716364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134919, "uuid": "e20fc350-899d-47f8-b766-b8fb53708475", "value": "12288:kEY2r0HjkeyPmiapXhMetxii+ZB/dihXNZKBb1enzccaAQs1JrUJJ8S3EyxdwSg1:kdfMAxDO5shXNkXeiG+Nt1XMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134919, "uuid": "19583603-ab21-4e7a-ba05-c9c1e7086ce8", "value": 802853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134919, "uuid": "55f2d2cb-6609-4dcd-b516-9e560747dce0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134919, "uuid": "3e4bbd3c-7e7b-4ee9-b5a3-950725ae8cf0", "value": "Purchase Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db57c4d-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761154390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154390, "uuid": "f69ce850-c5b0-458b-804d-ed0335967385", "comment": "Malware payload (Mirai)", "value": "e3dd5b13a3edce553468bc4464e080c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154390, "uuid": "e618b92f-5c84-4da4-a864-44b00a279a0f", "comment": "Malware payload (Mirai)", "value": "3e98eef752fb14582bfd0f70e00ae5f1b2e7ccb06b32597053c6ad8f0e591dae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154390, "uuid": "4f3de702-5513-41de-80bd-9a80b0968e99", "comment": "Malware payload (Mirai)", "value": "6022344b833112f271d1f6e07a8f9abd28282a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154390, "uuid": "62e204d8-c287-4c1b-b5a3-72f84c9a62ca", "comment": "Malware payload (Mirai)", "value": "aa10ab5fcad89e7ff0dc23b400ae5edbb90066ed7c8a3016b2e9617a43134e42ceb14f6244cd05fd8eaaea9b26633b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154390, "uuid": "91b5d722-5939-454c-84a4-388e305abda9", "value": "T10B13F1BA650815A183F50535D61CC486C6F71D3D70BCB0397D0E959A27A31BBBBE0F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154390, "uuid": "a4184683-c2af-4480-91e5-8bbbc4ed705a", "value": "768:g4pMYWW7zSiQWxyxrpOoG7f5xY8UZz1sQXxFDSFQs3Uozk:gYJ7mswhpO55pUkKIzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154390, "uuid": "7100b986-4f40-446e-9726-7c5736a373fc", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154390, "uuid": "8282211e-4507-4372-a5cf-2e4e0f8ee7a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154390, "uuid": "edd1b2cc-689e-4b9b-8bbb-1e6cf1d5fafe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc15724-af6c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761154229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154229, "uuid": "f29a1054-7dbe-4067-b89d-1b5e7062fad0", "comment": "Malware payload", "value": "0a35ea7e75d8e14029c763b4e80afc6d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154229, "uuid": "c6b8f306-c0bf-45e2-bd8d-de57ccee2fac", "comment": "Malware payload", "value": "3f1c3cf63de4ed1f73666aef9032ac58d0fe4af4cb6195028e98cbe95cc6c1d3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154229, "uuid": "342b2d49-f762-456f-86ec-399526181f52", "comment": "Malware payload", "value": "296dcd44ee5fe40e746c705a5b83022b98b407d5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154229, "uuid": "327a88f2-8f77-44a4-815f-8ea031b1423e", "comment": "Malware payload", "value": "a7a772f21ecbd1e1bf5687ae34299e4629f37cc1c5430babe6d9963685af7db340a1599f66d4203af8609b9920edb3a8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154229, "uuid": "f5758e5a-0c12-4768-8472-d4a5952f8808", "value": "T1741426233D265EA680321BB685FDA87CA1A64611528E2B32359D08077F45A575C8258F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154229, "uuid": "f49389ac-d118-4db1-bbcb-e96454f9ebac", "value": "6:q43taxtWKe6mEZbLjksmFWZT32g+V1X64mEF29chLYOoeMw5MWXfGu:Tgx0KhbLjvl29DrF2ILqeMx8Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154229, "uuid": "fa60f460-e8ac-4502-930d-aff8973f9991", "value": 196420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154229, "uuid": "430788f8-60b3-4b5c-a01c-cb9da677ada4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154229, "uuid": "42ab939b-0611-4149-9e8f-e7815042fd56", "value": "dfg90erhj34h0g0dfg0cvcv00340sfsdf84fdcv9bv0cv03dfiu3200fdsf23sdfvb90cvb90030gdfg0cvb09c0b0.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f15e00f-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137722, "uuid": "4f27cd18-9c1d-48fb-923e-c45409f38c5c", "comment": "Malware payload", "value": "2af51ea005c6d91d4e64d39cda951f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137722, "uuid": "d3dbb272-225a-4c3d-b42d-ae47c1d2cc2f", "comment": "Malware payload", "value": "403e48b84d746dd2f6772ed63679acea36508e9bee762049431117a214537932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137722, "uuid": "94119672-bd35-4ed3-9b61-e341e77dc722", "comment": "Malware payload", "value": "ca958d682b4a42e9f194634da84dcb0d427c202c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137722, "uuid": "6c747701-221a-4908-97b1-7f47a46d8b4d", "comment": "Malware payload", "value": "273ccb38ad8f90e5b71c23ae72094284e76981202ff9175f0a3ca20243cfcf7372ca8b278564432b2a48bb3e9133dccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137722, "uuid": "1d6d9138-e3f9-49dd-a487-b61cb1dcc969", "value": "T190715E88F3275AF1E43886F840D3A654C059ABB8C250BE8D5A60281E3C220BA255EF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137722, "uuid": "0fad55e4-752f-4f44-9381-6df22f978e14", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137722, "uuid": "2fd5ea28-2b78-4e29-bb18-8dede8fb9366", "value": "48:6Icwm0qEkVt2W+J8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jfEst8SNSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137722, "uuid": "56cd6cba-fc1a-4847-8ddc-a3e6ac5c0b39", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137722, "uuid": "3ba62faa-bc24-4e77-8277-492ec993f538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137722, "uuid": "1ed6c3a4-b400-4ff8-b17a-4e24155d3ba2", "value": "windows_i386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b96916-af0e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761113794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113794, "uuid": "1f6b7a50-ca09-4251-a48e-2cfd92eb29b4", "comment": "Malware payload (Mirai)", "value": "7024acc909167bde204569381fb87015", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113794, "uuid": "43cee816-27bc-498b-ab29-a39d3931ed37", "comment": "Malware payload (Mirai)", "value": "408dcce8911b600a58c46138f58e68b9e356d0e49751166ef8c43ebd356f8310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113794, "uuid": "160d05cc-9954-4829-abb2-180b5cd421fc", "comment": "Malware payload (Mirai)", "value": "d1061caf688421f940b4f9d0b74d5268008dfad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113794, "uuid": "cb9233ef-fa8b-428d-91c4-cbee26190284", "comment": "Malware payload (Mirai)", "value": "dc320e9412a7c11590a8836de4883703cd4b09b39d7aadce1b6e8682ec36f9a64c3cd0986ac1f5202abbdf590567558f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113794, "uuid": "513e055a-f15e-4244-b219-fb1019e93465", "value": "T1AE7301A47206CCFFEE2DC0B1C562151A4779B7F1910E884A5E7DE8CE9B046253A87E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113794, "uuid": "2276c5f9-5650-4f97-9e04-fe9081216615", "value": "1536:XGQ2UQ8F3+dLlKRwy2r0v9oFjfeN3rYpcj4IYIYG6En0C9RVJud:XjBQ0+dLlhy2IFohfcbx4jIYgbVQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113794, "uuid": "3116fd46-fa92-43fa-9513-d9c2fb1a36ee", "value": 74684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113794, "uuid": "a1b9393a-c511-4408-aca5-a75bfb1904fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113794, "uuid": "6dcfdcf3-e53b-470b-b2ec-966b57ccbb10", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a73541-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150677, "uuid": "22f2999f-4d47-4ae6-8960-6823ef79abbc", "comment": "Malware payload (Rhadamanthys)", "value": "3ecdff159b680724f0085b9d88e44d06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150677, "uuid": "9572fee2-f6c9-488f-b0c7-9f283e7ec8a0", "comment": "Malware payload (Rhadamanthys)", "value": "40c6f87cc45b30f1681cebf3b46022a4c06d82d4cb12efcaac65ef3bacb27aec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150677, "uuid": "63383419-316d-4eb4-8e22-3eacd8b3d043", "comment": "Malware payload (Rhadamanthys)", "value": "ae03a3839b70aefb11df4bdd93623c6c087d0796", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150677, "uuid": "2928e2d7-3573-4c21-bf19-1aa3ad4554f1", "comment": "Malware payload (Rhadamanthys)", "value": "0de8d15f15e9773ba43fa47bb2c2fb095757363594d8695f3ae855b3b779447023d61dbf49005440f4795c80a272394e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150677, "uuid": "07afdc70-5476-478c-abb1-6319d481b591", "value": "T1F5A31A191903BF690373BE692A5608EDA41D81DE1FC87655690B3B73AADCF0D2338D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150677, "uuid": "4f2ea65e-c56c-440b-9888-d1e1daad11e5", "value": "1536:GDB7eKg20ewWwfrJrclBwDQw6Nw1wew4AZwFwuwyjM6BkQWJ+aY:GDB7b0e7oVeBvJNm1mEbljM6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150677, "uuid": "22d317b9-3948-44e6-a640-72af42fe62e6", "value": 100712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150677, "uuid": "f6c2d093-0cf5-4ed4-bfa5-5b70c71afd24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150677, "uuid": "5c9f60b2-ea9a-4e78-b64f-0da6b9362275", "value": "invoice-1637482117.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a17bb74-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149686, "uuid": "eb56ad0d-4f43-4388-a587-0f5e4488237e", "comment": "Malware payload", "value": "5ffdf523571bc4fc2360efce904dcbcc", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149686, "uuid": "fb3ff107-4539-4fb9-bdc9-cd560d0d602c", "comment": "Malware payload", "value": "418646ca76525d60808d322b1c931b5c3d88150c0236af1d69d5da4e2971a9b1", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149686, "uuid": "fae3008a-81c3-4c64-9269-def31c0a5a26", "comment": "Malware payload", "value": "d09a195fcc7a2c8283193ccd0d2d0ec4c4936d11", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149686, "uuid": "bbe28363-1043-4bfc-a82b-2d5a245dce60", "comment": "Malware payload", "value": "99905ba9dea0741f1463044dbbb6c5ea091dc89c9d387033d8cd5cddf35e54b2ba3d25cbff73a944b3b5223e22ccbff6", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149686, "uuid": "c3f6dcc3-7d88-4ea7-be93-d20614dcd303", "value": "T17A122F52CD850CDE07A940BF6E65EA4CB47683BFC82D3E60705DCA76DF666CC42A14B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149686, "uuid": "168a0366-8376-40b2-b451-445049e8d972", "value": "96:xJK0jSzwPFlzPP1LXr+TPziU7WJMzD7lVu6KbHKXPLSc8ZYP/twUptv:xSwdlzPP1LXr+Tm0lVIE1rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149686, "uuid": "a6b79a5f-9b7b-4f0e-b217-5e6d45dd5022", "value": 9332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149686, "uuid": "1d210e19-2ff0-45a7-9648-6f8276db9af0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149686, "uuid": "934d3ffb-0a6c-41c0-a9d7-cf315ae0cacb", "value": "418646ca76525d60808d322b1c931b5c3d88150c0236af1d69d5da4e2971a9b1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027cd159-af9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761174933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174933, "uuid": "a9c35060-9886-4f89-b75d-4d5a88554031", "comment": "Malware payload (Mirai)", "value": "30f88810126e2be03eb600c94c0e266d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174933, "uuid": "640853fd-0478-446b-8053-e9c6c76fb1c1", "comment": "Malware payload (Mirai)", "value": "41d16099f3729d569951ef581015543cb985c9eafe0b3bcb16b94eb09166c662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174933, "uuid": "45594668-bb1b-48b7-b332-bc5982b6e94d", "comment": "Malware payload (Mirai)", "value": "230ccab07041abffc817df29d3ee86c93c7c2ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174933, "uuid": "5516ab73-f550-48ce-a78c-797b4f1af77d", "comment": "Malware payload (Mirai)", "value": "575468be85e7e09dd6f05aa40878e6d23848caca85e4e900345820885e4f9d19781b177b14709a36f02db89965e20542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174933, "uuid": "9f0a1a92-dc76-438e-83f0-24b4c550322a", "value": "T10F833B227A3A1F17C0D2A4BA21F74B50B7E167DF29A4824EBD720E9AFF115802553DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174933, "uuid": "13220f9b-69b1-43c9-84ec-d4f5df80adeb", "value": "1536:im4zUv10DorJvK4OJsi4nh0lUTVs8h1sCGMVXa2NRPF8KQTedb:p5Jr5Kx8h1sCG+vPF8KQTeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761174933, "uuid": "215c5333-790c-4ab3-b20d-b4f403ea98c5", "value": 85884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761174933, "uuid": "678be38a-8db2-4330-8a3a-9e73a3b9416c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174933, "uuid": "9823338b-e1cb-4e50-9eef-041c0f409d41", "value": "kwari.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead41220-af6a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761153418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153418, "uuid": "7a9b8a75-f75f-41d2-9729-6d2716f9ed5e", "comment": "Malware payload", "value": "0b1704151d80b4f5f21b2cc6fc72fe8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153418, "uuid": "496ed28f-10b7-4d50-bb77-2e3caead3e2a", "comment": "Malware payload", "value": "429f0a2d7538910442d96a8a31644967e2ddccbf693a4ff90898c750026b133f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153418, "uuid": "f09b5c58-e14e-4462-9ea2-8321be509849", "comment": "Malware payload", "value": "a9134a0d8b5bf768b30bba7fde7448277e180141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153418, "uuid": "fe5acb61-e9fc-4088-9c42-c98d13f627c5", "comment": "Malware payload", "value": "02ddb7099afe8901ae097cab8b379594e883c804d8e95c668962095e301c2c2d51a38a6b11c012809b798614f1291eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153418, "uuid": "05cb4dfd-1533-41e9-bbe3-1a9954d0590e", "value": "T103E54B53F66290ECC579C0B9930AA632BB72B889073176EB5BE047353E55FD06A3CB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153418, "uuid": "95ffe164-c042-4b48-b1d1-bba0a5591721", "value": "d13046b5c53da602273f8d036373818a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153418, "uuid": "f51ff6ff-6798-49a9-8b26-e3e47f8db505", "value": "49152:zBXlAVpsdjNUPo63HZcym7PQF8iyYo1itsfo6VBIguxy0prUiaOEWzIU6ig:9AZBGDYNp6VVO6+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761153418, "uuid": "b016fd1d-e351-437a-b1c1-9ababe7af1e5", "value": 3181568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761153418, "uuid": "7a79ca8f-43de-49f4-a171-704e5061f550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153418, "uuid": "db3444d4-d02b-4f1c-b5bc-b1d3a3a22266", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60089f8e-af0e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761113672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113672, "uuid": "c7da175d-8f68-4449-afcc-84662d0fb445", "comment": "Malware payload (Mirai)", "value": "e1df2d6792f710a00afcb5a4352280ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113672, "uuid": "f156b174-a21e-4cb0-8cf9-bbc93808f64f", "comment": "Malware payload (Mirai)", "value": "44de6b7d6e548827f3e5e26fa5fee480f7a29649d171a6d59a9f55751852bdef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113672, "uuid": "59522adf-f493-4541-98ca-f0b0121941c4", "comment": "Malware payload (Mirai)", "value": "7da2cb0965317a65bf168f83b4e615575783f9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113672, "uuid": "6789bd59-1db2-49d4-9cc5-8cfe30250455", "comment": "Malware payload (Mirai)", "value": "ca527e7e5efe4bfc191173cca407cf16ef6c6514571aba36be1722c7fc9194df5b5cae2deaed78321bab5b3c3cd8c012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113672, "uuid": "e0153f2e-1e74-46df-b632-1c4382f75b47", "value": "T17B733B227A761F17C0D6A4BA21F74B1077E27BAF19E4C14ABD720E8AFF115802552EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113672, "uuid": "ff3f7237-c8ab-4e8a-b305-89d3a8609f70", "value": "1536:ArZevLXqVEFm73W5Ed4NPHwC3m4IsL0zmBsQRgi6frLlBEv8Q2opakvOPF8KQTYh:6ZevLXqVEFm73W5Ed4NPHwCXLOMkoXvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113672, "uuid": "e0835186-22fa-4e9f-afc3-b2bcf437e1af", "value": 78628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113672, "uuid": "e099a588-4e7d-41f6-b86c-373823dd8857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113672, "uuid": "f0296a6e-5689-4100-a900-5835d92c5844", "value": "kwari.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38412996-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1761154407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154407, "uuid": "93d14d07-e3e1-4284-81d2-fdd562690905", "comment": "Malware payload (Socks5Systemz)", "value": "7b445af173530a001819d0ec466592d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154407, "uuid": "73c6b744-ee70-46a3-b476-476f840b0aa7", "comment": "Malware payload (Socks5Systemz)", "value": "44e86ff870563500e3162ebf3335d66ec3c89c4f3872cb591670d9c6a542c130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154407, "uuid": "e864c189-bb4a-484e-81ef-447af70b0efa", "comment": "Malware payload (Socks5Systemz)", "value": "04ed9001e3fad309a3333cca30b00ae73ac78c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154407, "uuid": "d1d76de1-b87d-40d3-a13c-1fd05dfcaf94", "comment": "Malware payload (Socks5Systemz)", "value": "4f69aa65bc7a6efcfeef605ecdf8661f3cc2530f68ee8ce226adeb84931a804c9df36fb0f4ed64170dc3a59db263b224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154407, "uuid": "b3cb7f58-55f8-42e5-9b7a-ed0a0219ad51", "value": "T1F806336BD3A6D536E323DD74B9A4C18800F732580DA6A579642C6BFF9B3ED0890727D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154407, "uuid": "68ad3441-4bf9-4075-82d8-6e1029049b6a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154407, "uuid": "bc2f43dd-75c8-479b-8e28-2168c7cae0ed", "value": "98304:Mf9Rt/XjBhGpaLQovAP92Q83BS1yGGsXsH52:I/XjiAkw7RjGGsXsZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154407, "uuid": "2412a912-9d72-4260-bbf5-c8896364e290", "value": 4018527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154407, "uuid": "f3fe4fcc-aae2-4309-a2fb-6261b3abfd2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154407, "uuid": "f38a9887-5418-4965-adbc-2cb44c12ff76", "value": "SecuriteInfo.com.Trojan.MulDrop26.51718.15245.32017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fcaf0d-af71-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761156221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761156221, "uuid": "cb495fb7-f03c-4b65-9b1b-9378bc701b0e", "comment": "Malware payload (Mirai)", "value": "21db4249225b77f50677db5d3eccbd1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761156221, "uuid": "661a8fd2-c1b1-4432-8454-9c0147e0972d", "comment": "Malware payload (Mirai)", "value": "452a0c93f439b4eeb230d8a3b2b01934b286283bdcc509cc56f09734f1b667ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761156221, "uuid": "1dc0a308-67e4-4031-9f75-91d854d9fa86", "comment": "Malware payload (Mirai)", "value": "832fcd5cf8aceb435bcdd828f1a2fc7f157e4833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761156221, "uuid": "f62bbc73-549d-4e05-8688-5726c234f21d", "comment": "Malware payload (Mirai)", "value": "c36d747a0806a2d1cdc8c17f3db65ff1b708134a097db195eaefc683584a0c0534753809b2eabca8ba8a547a43a5b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761156221, "uuid": "1529cb64-3481-4e1e-a2f4-0e300095080b", "value": "T1EDA33BD7F401CEBEF80BDB7B4457090AB931A3E106831B276757B963ED361961862F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761156221, "uuid": "9a0dfbcf-22e9-43f6-a36d-f5c2a97a42e0", "value": "3072:CNsIIb8bhZARtRzy2BVyGaKKiuFs+3Tv3v:VrPy2PyGaKjuPTv3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761156221, "uuid": "dcffe8e2-d1c8-47b7-baac-ff8a08ad5006", "value": 100892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761156221, "uuid": "ef0f21a3-6463-403c-9d13-62e1ba12e5d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761156221, "uuid": "a1dba112-3c17-44a6-8980-6affb72e83b7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749f23fc-af32-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761129168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129168, "uuid": "f9f15506-1f38-474a-86d1-b4808b12cd0a", "comment": "Malware payload (RemcosRAT)", "value": "e82812e81d4c585f5f5d7ddebe14e3cc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129168, "uuid": "4a6876ff-dfda-4f65-b76a-4cc3d51866c9", "comment": "Malware payload (RemcosRAT)", "value": "45793d908fa5f1e15e1c4ec18c8af122742c55455df13fa874599b7f7df9d7be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129168, "uuid": "98df3c3a-e9a3-42e0-a459-35d28c50d0a3", "comment": "Malware payload (RemcosRAT)", "value": "818e71600930e1df259fb96544bc523aa15507ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129168, "uuid": "82eebd6a-43fb-4bd8-b3fc-85583b50937f", "comment": "Malware payload (RemcosRAT)", "value": "340732093b75da0977309079418c0cba2577ebc5def9130b9a721a9056806724735ba17e97fb0034cd7ec2d648f24da6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129168, "uuid": "c6a97cdb-3633-4e73-a1ed-454a5ed6cecf", "value": "T17A6423680BCB628BD3D382FD5A6C8A61BB773683501B3275FBD5C24C9F6835A1236548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129168, "uuid": "930c4222-0385-43d7-8fa5-948968ccce4f", "value": "6144:Ofk9KPuThcPhAeXsiz6Q6lFmlLU8WhM2LWq4YyP8QNB/1wMs/x5hLJzi8:N2tsiilF4LUTJLFyUa/+Mspfg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761129168, "uuid": "c48ca8f3-bad6-4e36-9321-dc4c488673e0", "value": 320487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761129168, "uuid": "5de36e14-f1cd-491c-9230-2654fecb25c8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129168, "uuid": "38f98b81-b023-4a8b-8ddc-444ff26e0d8b", "value": "anfrage.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebd9775-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150553, "uuid": "67dc5bc5-aa49-47e5-a82d-493f04647019", "comment": "Malware payload (Rhadamanthys)", "value": "99a29712dd120191277a3f8e41c2438a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150553, "uuid": "7fe5cced-7af0-4b27-8f7e-b0e070756482", "comment": "Malware payload (Rhadamanthys)", "value": "45c1583ce310ac8a52fe220159c2a56b4cc32c65b0f38126130fddfe76d7c45b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150553, "uuid": "96ad48ad-5de8-43cb-8853-a8be287d86a8", "comment": "Malware payload (Rhadamanthys)", "value": "b85aca3a2504e5d20efa09badb44c0935b319ac4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150553, "uuid": "3844776e-bc17-40c7-b2ec-9a0c87a7477b", "comment": "Malware payload (Rhadamanthys)", "value": "d385533047fea9d42b4229ef5c5c5240e8ea69eac26ec9a8e34a8045ec5e5ddc917715b5fbf783b6c59423dc08365c8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150553, "uuid": "247f2cc0-dc6d-4392-8f9b-b74e7fd62e42", "value": "T1C2A30AC35C4A9DF0A37AB1320421D5C19D9475C9CC9692EC8E883FB2D849A3F76991FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150553, "uuid": "6a502428-09c8-4c0d-8eb6-0ecf757af8c0", "value": "3072:GDB7b0ZEm3Em7/zwEmaEmkWEmNEmSEmtEm3EmkEmRoL6BkQWkp:03HizruB116xB+VwWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150553, "uuid": "cabc4de8-ba29-41a8-a0be-10abb1672180", "value": 105398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150553, "uuid": "0d95c5f9-734b-42dc-a820-f5c814a1e4c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150553, "uuid": "199d8aec-f655-4b2a-a9c6-cf237989f919", "value": "invoice-1637482117.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9549e874-af0b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112473, "uuid": "57b04cf4-cdb2-4340-86ed-71bc21876277", "comment": "Malware payload", "value": "e7e0962c88be15d49e181cdd33064ab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112473, "uuid": "c0b052f3-eaab-4dd2-8e4e-1918a9bdd96a", "comment": "Malware payload", "value": "45c940694bb2098491643a7aacf95aaec6404ad4fb2af6fc14e28785ce05125e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112473, "uuid": "fe842e64-e79b-481f-b7ad-619abd0096ed", "comment": "Malware payload", "value": "f995e0aff2ddb13ebfe396c6c8e925775dd091f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112473, "uuid": "e32e2eb6-2e84-48a7-8e36-56e8506e44f8", "comment": "Malware payload", "value": "7f5cef9a0044c587111fe3f6db1b53cd229c2e29d4c334dad9f0a9972239900ecdcd4cf6e94e11f8eb91b65dfaf2ed71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112473, "uuid": "dd5b827c-2b58-4111-a28c-7490333e8f75", "value": "T17634638ABFA03FFFD81ECD3302959A09129C490A52D8AF7A2B34D514B65B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112473, "uuid": "2d4631a7-421b-44a2-a113-23753578be91", "value": "6144:E4+6WrSYzSEs2VHo7A/93HPQHcuw4i3k2O0Vl0fjNjX5M:2ED7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112473, "uuid": "ca0d2e62-462d-409f-9b84-aeffcb506743", "value": 231536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112473, "uuid": "19190d56-e309-4b7a-9572-d86c7ef3f054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112473, "uuid": "1fbd6d7c-2927-41b8-9569-4feb83af0738", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a4f04-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761113451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113451, "uuid": "e91d2921-4987-4d03-96f3-cb7f7c9752eb", "comment": "Malware payload", "value": "6782de04fa9fd8c08edb00a3fd2b91cb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113451, "uuid": "55d4616f-37f0-414f-823a-bac01cd45f57", "comment": "Malware payload", "value": "45d70d98f8faf47183b3aa3665db49816109d14e27e9a685943c49911885d5e3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113451, "uuid": "4869fada-edd1-4c6c-9f69-ad487bd73413", "comment": "Malware payload", "value": "b8665d4a4a5a8d4fbf4cbbb34f4996cec41e5a9c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113451, "uuid": "145e9819-cbe8-4958-b381-96b62cecf2c2", "comment": "Malware payload", "value": "ec7e12e355b9b05376738b5fbad9a9ab9219c7069c5a1f21252dd34429b9462b64f192bffdb953af60a15187166f8f0b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113451, "uuid": "ae9e7f8d-2816-40aa-b9f6-245f356d7260", "value": "T1A3E1099991724014D31A60B761862112C73CF612164F2A07BB70BDDC6EBF7E2A76E1AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113451, "uuid": "83d4563a-9291-43cc-9b25-bd740c04fa17", "value": "192:pW0ECw5OV8vdQjmEFP2bUQYuDpjKg7lUcC:pW0Ec8qm2PNBuDp+6lUcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113451, "uuid": "4b65a279-f1c7-4bac-83db-faa54513c486", "value": 7142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113451, "uuid": "5379a1f6-bc03-472a-87b6-264fc045cc3b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113451, "uuid": "864bb612-e246-4487-aec7-9f129c9d4e8c", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5032f4-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134877, "uuid": "1a78bcd9-483d-45db-aab8-d29889de825d", "comment": "Malware payload (RemcosRAT)", "value": "ba3f5f1b7666d1f1ba5dbf3f2b680f03", "object_relation": "md5", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134877, "uuid": "7682415c-6783-453b-8314-d1e7eaad31e5", "comment": "Malware payload (RemcosRAT)", "value": "4718836be88f634ceaf1a70bf81b1efa2e589975c78c3d1436b3c8ee89d071ef", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134877, "uuid": "ce923fc6-513f-4443-b495-20d80c442d0a", "comment": "Malware payload (RemcosRAT)", "value": "fa39869ae48559c963b46ddd83418fd4e7f26434", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134877, "uuid": "2a49ac36-f09d-4914-aae9-b5ed6e9c7256", "comment": "Malware payload (RemcosRAT)", "value": "629eca0f7bf6db7d947cdba5f785268cf7a3ff47a48968d58b5ec8bba0b4c3c861f0fc376b2fb3975ec6fe03eec4cba7", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134877, "uuid": "22d67fb8-3419-4cb3-8955-18b0b4537f86", "value": "T1DB3523196F42ACAD812C833420A8BF359BA8AB94D239D1DC17D1B0C555BFBB6C647CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134877, "uuid": "d28ff0a5-2929-486d-ad2c-923f75f3a6e5", "value": "24576:hKw06qzmngues9mdPC/jA6RZBWahIzooB2N2dtgsJTgy/CXq:hLixfkHzgjC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134877, "uuid": "0f9d1bd7-d026-4018-a6f8-1e552fd57686", "value": 1089366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134877, "uuid": "3df7dcf9-33dd-490f-ae3d-aa0334d4c99c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134877, "uuid": "82950ef2-d833-477f-86fd-bc56f13488fd", "value": "Bper.Banca.Copia.di.Pagamento.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba03a0df-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112964, "uuid": "633813fc-8589-40d0-90a8-dd821bb17d49", "comment": "Malware payload", "value": "a127efd1ee30d048ec9e577bd27a3579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112964, "uuid": "69333f4e-b398-45af-9451-9690fdfb63f0", "comment": "Malware payload", "value": "4766dd0fbacc9df6c5508b198deb1fea3d529c727db27d162108f88bfe9aac57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112964, "uuid": "88d4a357-2cae-405b-9270-4832d75c6238", "comment": "Malware payload", "value": "0347335a3d3781e54c1b49ff19dc61565923aaaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112964, "uuid": "6d8bac00-3213-47ba-a450-4fb546a50205", "comment": "Malware payload", "value": "9b07545b2209703955d5aa249d40fa710ecf2884ec205e94b1eb07d9e175ec3abb28b4d5c18ecba02c3714e3d59c93d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112964, "uuid": "b3a5d231-2fab-4b3d-a1a3-c1d7c6b716c9", "value": "T1BA363807FCA545E9C0EED235C9669252BA71BC484B3023D76B60F7782F72BD4AA79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112964, "uuid": "22856593-c5d1-453e-97d6-5f595ebcb90d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112964, "uuid": "7109e633-9895-4eeb-a82d-89ae2b3761e8", "value": "49152:307k31IFXWJFd6FcQxGkVVltmqyku2cjs5EvZGq2qICIwyu:3FIaAjZEV9Ivxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112964, "uuid": "9cc06139-9e32-4367-8bf5-c79e9fa497a3", "value": 5322240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112964, "uuid": "b29399cd-8bf0-4584-95ee-4c9bf73d2da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112964, "uuid": "9e35dcbb-aa7b-4bd3-a016-b20e2ede2974", "value": "Winnnit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30f9b02-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135823, "uuid": "40e8ca51-f60f-4484-83cd-f492c0fdda33", "comment": "Malware payload", "value": "bf0f8d7e895df54aeb6f19778b02e41d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135823, "uuid": "523ac63c-8e91-42bf-9b53-4aa573afaa43", "comment": "Malware payload", "value": "4795f69e13b2372467b70982e3c6df24c5253ef1df7219e708d0737a1de22d30", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135823, "uuid": "6e7883dc-8484-447c-8210-2ec371d7e35e", "comment": "Malware payload", "value": "513b34dbb7cb8721b56837a0f0c3dfa9295c8071", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135823, "uuid": "5e2aad2f-8438-448e-9d9f-466aefd7e555", "comment": "Malware payload", "value": "88c12ed538be8945a038f9e6c97e6acd48413fde104bdc61a7ed31bb92baeeb17e49e1b810e9c70b21ea40bcf419520f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135823, "uuid": "bdb11aef-0991-4e79-a953-fa69686a682c", "value": "T193352309AEE4C742C69B52F05983D71B349DBC5AAB92EC277345B79D3138BF0299302D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135823, "uuid": "cfadffda-d80b-45bb-9c7e-0f9e62c6bfed", "value": "24576:JMg+8R8lxvghuKGcGnUty2Wr5GbHThcJbFYnxSUMpNB:JMg+8IoWdnAPWAWmiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135823, "uuid": "9f492ec5-184e-43c1-a464-45b188f2b8f4", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135823, "uuid": "1b90040c-7401-4e58-998d-dbc0465293a1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135823, "uuid": "88452f0d-2d06-4e67-9d6f-df298ee6121d", "value": "Vingis_rn_Talep_Listesi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c721505-af98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172936, "uuid": "12756cde-5517-48f3-b541-81b3e8636cd7", "comment": "Malware payload (Mirai)", "value": "7f393a2b9dc68418b6df7eed4319fcbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172936, "uuid": "97a4f887-445e-4445-b113-d80eb04d2c65", "comment": "Malware payload (Mirai)", "value": "47d32622f4bec58071a92bf30c8ec278a81149dea78143b8cd030ad07bd94ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172936, "uuid": "3d4e0226-ac70-4956-b01d-b235642b0057", "comment": "Malware payload (Mirai)", "value": "8b3dcb32e472b6dbb2b5928b00c41b65e68fccac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172936, "uuid": "1272ab8b-a1a6-47db-892c-2215b52bdbd3", "comment": "Malware payload (Mirai)", "value": "3ddffa176bdb25f472d74d228ebb93339215d65a13f636e514dc508bcb4d4f062fb8250eb54ec8e301e5bcd1a0369317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172936, "uuid": "e2e85e40-77d4-4ca4-b652-b3164e7c1465", "value": "T185F32A45F8914F27C6D622BBFB5E428C772617A8D2EE72038D256F24378B95B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172936, "uuid": "14c5ca0c-f662-4152-8464-99b09c9c6e11", "value": "3072:tEXxcQ9h7ptb+EVdhX7P4cPwWv96xhsQK2mG:tEXbX7LdhLP4cYWv9me12mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172936, "uuid": "a9bc4e85-4f6b-48d5-aa27-fe8180c99beb", "value": 160932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172936, "uuid": "822b4ea7-3d6d-4132-8968-d12c280a3740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172936, "uuid": "0167a8b9-db8c-446b-a874-118bc92711e1", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6595fd-af91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170118, "uuid": "6b06fea6-3d2f-440d-a09e-ec0188e2fbde", "comment": "Malware payload (Mirai)", "value": "32414bd40dd9348777eb8f23b61fd1f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170118, "uuid": "30e64c4d-a5c7-47b8-9a52-2d4be42a7a8f", "comment": "Malware payload (Mirai)", "value": "48659e661412a5820844c82ed29bfa01fb28076bdb8b6beccc7211cea8a675f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170118, "uuid": "fc9f0333-4161-44b3-83a4-bbdb8546bbf9", "comment": "Malware payload (Mirai)", "value": "7e9753c5de25ce2df57b940a4ab1aceb09e2a43c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170118, "uuid": "73164c62-b7d9-4c49-9965-929bd06a1c62", "comment": "Malware payload (Mirai)", "value": "956caa434418d8d59daf1e0d9d93e11a1b8e11d41816a9cedcdbc39a5d8c07935fc2b567c66a8894779aee360c25c125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170118, "uuid": "6c8ceb1c-f26b-4468-9949-bd0eac9a4cd0", "value": "T1CCC38CA47E4F3C51E3C7E37DCE484B72711775F4C66192A4BD22432EC4EA8AA8EE0552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170118, "uuid": "0c57e6cf-8b8a-4ac9-b7ff-7996a7c1227c", "value": "1536:nqxL8mA0YWrImKN5YwuqS6m3zV7lEX/DefKuKaJtNTk1FR5lceHm:nqxomKc1wz0zV7lEvD4pNUb5WeHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170118, "uuid": "69fefff9-7b55-4e41-9a58-68fb9dee3f41", "value": 124760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170118, "uuid": "e4871a4b-79eb-4db8-bde8-4aec4a4e9c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170118, "uuid": "d1a03e97-87df-4287-bcd4-ba6b8c7ab98b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c17a09e-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761112860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112860, "uuid": "1e0755b9-167d-477d-91cb-91046366aa52", "comment": "Malware payload (Mirai)", "value": "3ed5e50f6ce5fe0dcd68322e5cffde6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112860, "uuid": "2eeb28ae-7a9c-4d86-bfdd-35e3566a3c96", "comment": "Malware payload (Mirai)", "value": "4a254a3c08af9b7af32f260c4a90b9e137112e5774814ea4b26b71d0deda0626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112860, "uuid": "7533e088-5028-41af-8641-eb13a5b53f35", "comment": "Malware payload (Mirai)", "value": "c415f8e7d441a9ab065f397eaa1ea8cb032a649f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112860, "uuid": "1e0b1c4f-2136-4113-bb2b-ef89c97568a0", "comment": "Malware payload (Mirai)", "value": "92e3d0479f84a8237341a6c95db6e265924717e7bf51cab338c2ca9971f90de5d01e273df800d25571cedab99867e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112860, "uuid": "a740131c-8e6a-4380-82d5-f3f15bf3f8c1", "value": "T1DB6302317759DBBEFF0C00BA1ED01260B46A947B93955FE65088ABBC2D9E7807C177A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112860, "uuid": "97b96b75-71ac-48ea-9b71-134caeae7a3a", "value": "1536:VjX8fkc6aPwkZPD4DGlD6ERd5nPVG/XVzeNR0PiNTszAg:p836i9kS7pNG/deNRTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112860, "uuid": "c79ddcfe-8414-47e7-bde8-fdcd03bf1d93", "value": 71076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112860, "uuid": "403c0c77-d83f-4b15-abb8-945e2185afdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112860, "uuid": "0158a799-c0e6-4cd3-a6f2-197d89b4d9e6", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6522d8-af9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173797, "uuid": "473943ff-1ee7-4adc-a911-3a2a33139b89", "comment": "Malware payload (Mirai)", "value": "fe621ecc5cfdacb10932bfc6129d3afe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173797, "uuid": "a92e7dc4-01f1-4759-8cf3-e20df6496179", "comment": "Malware payload (Mirai)", "value": "4bba90491139ae223d5d2b73132a1e523190cc145c28593769d8089657a0948b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173797, "uuid": "6e813ad2-1558-4ef5-b62e-bf8dab8bf71e", "comment": "Malware payload (Mirai)", "value": "deebb9a6377761aaa2bec41960cb62615907a081", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173797, "uuid": "57ca2af5-0fe0-477c-a35a-f5d8f532a573", "comment": "Malware payload (Mirai)", "value": "05543e24b1066f944d16068a400bd185cdb07746d3c3cbfa35fa8e86e67f9e9ce2e1381310a5759a68daeb161b0c6dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173797, "uuid": "2852bd27-40c1-4944-8cb2-22a9c2bfcc38", "value": "T176F38C32C8296FA8C66595B4F0B0EF7E2763956086431FBA19ABC7B58043DCCF9057B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173797, "uuid": "0f5aaeca-7fb0-41ad-966f-451dfc741ac5", "value": "3072:TrOLxd4iT1K+LBDEf7HBMcmWvugnftWLG8PwxOG:TrmtU0W7HBMurfYL5wxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173797, "uuid": "284ef72a-b3e1-4239-8441-dba8795eadf0", "value": 172548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173797, "uuid": "b8c6088e-8da2-4718-a82f-9f6764cd554a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173797, "uuid": "7fc4c6ea-38d0-4d43-a93f-53b089dcc74a", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaca633a-aee4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761095866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761095866, "uuid": "cf228831-d28f-4c32-9e19-aa069a0288fa", "comment": "Malware payload (Formbook)", "value": "2dd9f27945c296c050f8faf26d2b6db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761095866, "uuid": "e76946b7-491e-4729-815a-1e162bdbbbe2", "comment": "Malware payload (Formbook)", "value": "4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761095866, "uuid": "7cdc6705-aa7f-4289-8fad-3f11b271378f", "comment": "Malware payload (Formbook)", "value": "66d65be005f96ec3cd8070fc9f5f4b94d4fba8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761095866, "uuid": "177570e0-a9ea-4d09-af2e-08480eba985b", "comment": "Malware payload (Formbook)", "value": "b7344b7e1875c7161ee635ad54f41d72018fc063a73332dbc45def880bbd8cd6cdb8b5555b0bed1038f15c98b6e6a9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761095866, "uuid": "c9271845-5ce1-44b2-ae74-d0a1a0a13bca", "value": "T11CF4235399E0EE58C18463708432CC925A783061AD61B32EA33DF5AA7C717D3DBB674E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761095866, "uuid": "a4bb876f-dced-420b-a594-b9f296e01051", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761095866, "uuid": "9b24ea65-4905-4253-8f06-4e8aeecb1966", "value": "12288:Tz7hU5I5yuNHIgzSFKxWltRohBfSTso93USkOUvJ+bF3zpBw052cajVUDRp5zNkw:Tf+iN57Gtene3JqAbF3fwoOVUDRp5zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761095866, "uuid": "7446b59b-866b-47f5-a39c-f018abee27f4", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761095866, "uuid": "41764430-9479-474a-8d4e-a3e9d0a6357c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761095866, "uuid": "b14c7f4f-fb66-47ec-9c7a-3091a2f94cbe", "value": "NEW CUSTOMER ORDER REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da7fec9-afa1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176911, "uuid": "f3a70bc5-904f-46a4-8bf6-5342bc3de01d", "comment": "Malware payload (Mirai)", "value": "2adb25f53cb5222f18e721990ae895d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176911, "uuid": "3759755b-aaa1-47e4-a6d8-9e10deac60ad", "comment": "Malware payload (Mirai)", "value": "4c6748f9c3235d9a9ad41ed8bb6e007caa446c33a9d8f7d3253554df84e4c935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176911, "uuid": "681ab01c-0afc-46e3-92c7-dffc9a60ba82", "comment": "Malware payload (Mirai)", "value": "612c90575b6ba568ce5babccf36b17430aa873e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176911, "uuid": "1c58f5bc-1967-4d10-9386-4c90ee93afd7", "comment": "Malware payload (Mirai)", "value": "348b456b92d2e43669273566a75d143042b73cbe9857d8e9fbc3bc87650406730c21fa1e0f0a2da6429ed1c5690a487e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176911, "uuid": "cd415812-bfb5-4e02-8f5f-0e178965ba51", "value": "T1E034441A2E22DF7EF66C873047B78964979832D636E1D645F26CC31C1E6024E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176911, "uuid": "77ea0ed4-8966-4b35-bda0-dcdac9a722db", "value": "3072:zYx06WXdc8URBzVQbL6IhxGyWZ1pPEiJODkC239IL9BDjt:zRXqRBza6I1qf7Jm923qL9B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176911, "uuid": "2e2540eb-e364-4c04-9268-2e996b133b79", "value": 240976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176911, "uuid": "5eeb7866-1044-4cbb-8de7-6fd3ba64d599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176911, "uuid": "5d786694-31a0-45bb-8303-a969bddcbf93", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3dee23-af0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761112354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112354, "uuid": "1177cfa7-24ee-4ae0-86e3-656424e3d94f", "comment": "Malware payload (Mirai)", "value": "614a06b07c78568965557caa031706af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112354, "uuid": "6f502394-1a73-42a5-83b8-3893eca8d470", "comment": "Malware payload (Mirai)", "value": "4d24497648988eeb46edcfd9d1d2eb8ff5afeb73ce9b5f78fac913d48c09e6fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112354, "uuid": "fdb4feda-4c33-43f0-a449-de6bce78c1f0", "comment": "Malware payload (Mirai)", "value": "4209ea4845006c1dee9b02f8968b5ab6214c4fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112354, "uuid": "a797f92f-2074-4a70-8826-a382b78ba23e", "comment": "Malware payload (Mirai)", "value": "ad69700b540bc3619f04693e1898d84bc00e9910f656ac9160b001589109a6f4f310a1d50befd43a6cef631f113b9e25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112354, "uuid": "0787d101-0a1b-42d4-a086-35db2bb12681", "value": "T140D3F885B891AB21C6D156BBFE5F418E33131BA8E3DE3203DD181F6477CB94A0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112354, "uuid": "e1cca623-f938-419b-93cb-8ad44e5823fd", "value": "3072:Ba+Sx87g60tmWY/HQCXe1xXex7zj6DI+zzEe37137nzC:Ba+Sx87etmWY/HVXExXeR6DRzzV1vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112354, "uuid": "4ec03a4b-7b46-448c-b496-6cb52f099990", "value": 131828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112354, "uuid": "ee0ef018-c0df-4b4a-9c01-ab77092f2042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112354, "uuid": "269041df-e5e8-4bf8-99a1-7d1dc3b20610", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f78964e-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150473, "uuid": "e115f95b-8137-41a3-a4f5-38f36e82a477", "comment": "Malware payload (Rhadamanthys)", "value": "ad784834fef50dacea970d427c8ac33e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150473, "uuid": "29372188-871e-4f5a-bf4f-0d9a480189e4", "comment": "Malware payload (Rhadamanthys)", "value": "4dae9be3bf8a8f2d09f5bcfd5f0e0dbd35b6fa812bea8fa5d748b7e30657a14c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150473, "uuid": "3a4531cd-8595-4846-822e-88da9e01b9c8", "comment": "Malware payload (Rhadamanthys)", "value": "a94183641e59feae6a9c060d572cda7e02ff8129", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150473, "uuid": "bbcf7fc9-c7ee-4f6c-a58f-d21432bfa67b", "comment": "Malware payload (Rhadamanthys)", "value": "aff9d6abdd8b2d83a992ea8e357327b1de8abb2bd199e63982297f773979169071a3e5eae0f185b2426d9a8b450097fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150473, "uuid": "39300ffd-7b52-498d-8df8-491c20aa79e1", "value": "T1F2A3D6307D6678B40A64BF5D8DD817358A04AC06F609FAF6804FBF087A4CB4A7F1D696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150473, "uuid": "ae3b791f-c7b4-498a-9751-7cb69746d50a", "value": "768:GDhd0i7J4sYKgY/CMNfWdvuSunuauhuRuIu+ueuSuDuXuMuEubuTucuhuju0uPu/:GDB7eKg20wrproQiZpAvk9Z6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150473, "uuid": "395d50a7-a8a7-4e52-8c97-f9e969b1adb7", "value": 102712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150473, "uuid": "9a45f4b5-984d-4314-9149-8303f2d18396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150473, "uuid": "6437b3d0-56ad-4572-87ba-c6b31ffcf3ec", "value": "invoice-1637482117.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33811ada-af09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761111450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "eeda194e-276a-4d34-9c81-1ff9d8717b95", "comment": "Malware payload (Mirai)", "value": "e63b8a105a1497924314c2a19f0d1762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "218c3a4f-6f34-427e-90e6-f06aa6861bf4", "comment": "Malware payload (Mirai)", "value": "4e1aaec543c500e9b66072605870d8d41909aa006205e4762df0c435c035624a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "3060a2c0-8ad6-43c3-849b-0bec1f4e654c", "comment": "Malware payload (Mirai)", "value": "95cab5ee2c78abd27a9e0f9e9b417e31b036f540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111450, "uuid": "82e6fbf3-244d-4ff6-9a04-71df8f9911b8", "comment": "Malware payload (Mirai)", "value": "fe948c501b03882f5aebf420bb647c0beae9991c33693925eca665f944d4db1a8103c0268a23babd7c904a9ac9ea73b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "ee857697-b8d2-4e9e-8e14-7d0d2b940988", "value": "T1CD730712B9818F13C5E112BAB5BE418D372477FA92DB3253DD212FA0778286F1867F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "aad404f4-d117-4fbf-88dd-7b4aec02b264", "value": "1536:IBJqqSTrfnRkyXtyK2nDGz10nf8hds+i+1gA4221q6H/pOEdhQz2WAu:IBk6+BY22A2/gEdhQz2/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111450, "uuid": "bb9f2d8d-0acc-4795-99da-4cb4f93c7f2e", "value": 78064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111450, "uuid": "ab22226a-62fe-4fdd-be7d-0de3cdf24f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111450, "uuid": "351fcacf-c8e4-42b2-9c59-387b92d47229", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc89c96-af22-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761122282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122282, "uuid": "5dad652b-b89d-4795-977c-8cc567f87b18", "comment": "Malware payload", "value": "8db2ce83f1d3ff98394370963bdcbaf5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122282, "uuid": "643bc6d0-66fb-4399-8a51-ae8f1c3ce137", "comment": "Malware payload", "value": "4e26701343de98398da6dbbdfe3fbc05125747ee2cf91c2dc5faee00c1c1ceb7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122282, "uuid": "91fcd756-a10a-4630-8f21-4564de830cde", "comment": "Malware payload", "value": "c12b8f4ef243fcdd9a8f4521e661b546471ecb00", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122282, "uuid": "a39c5f64-014b-479d-921d-0340119d0480", "comment": "Malware payload", "value": "21e51c7a9309dd4205915cf709ff40c729391048434c62b7e1097f04a77c24431071bb10cea4008ee35082245cce402e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122282, "uuid": "4fff5e27-dafc-4927-9e19-77dc5102dd2e", "value": "T19AA533FB8025E5DFAD98CF26E0953DC32C9B655825538D3CB40C82A7E7B7EE8B149850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122282, "uuid": "1a09965f-3a12-4481-aab7-0ba5e43c545d", "value": "49152:FylNhUe+TPfts3QKLb9YKiQWvqUYntQSMn8w6/7dXyT7Jkl:FuUe+Tn/K/9XiDyUotQSMn8w6/82l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761122282, "uuid": "2b2cc66b-27cb-488c-a532-50cc107f84ad", "value": 2166016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761122282, "uuid": "02ccfcf7-4cfd-451c-be30-49d562a8207c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122282, "uuid": "c6faf4d6-339f-4bdf-999f-25fb084ff2d1", "value": "INQUIRY LBS75773 ANDERSON GREENWOOD.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558790b3-af56-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761144578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144578, "uuid": "9e0a4317-a698-4fd5-b625-f707389a6687", "comment": "Malware payload (RemcosRAT)", "value": "f6c3ea6db9f03e8eb05ad58cdc56bb90", "object_relation": "md5", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144578, "uuid": "826a15ee-ec46-4f83-b644-e987850adb36", "comment": "Malware payload (RemcosRAT)", "value": "4e3c3570d344cbd5cbe17694c8fcb740935539e2c8376ebb60f9fea6c6b30003", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144578, "uuid": "34dc5a37-8ecb-43dd-bff9-d649170423d6", "comment": "Malware payload (RemcosRAT)", "value": "6686392ae7f604395a22e358504d2b10d7c7c346", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144578, "uuid": "1450ba84-a65b-419c-93cc-92a2f4b84826", "comment": "Malware payload (RemcosRAT)", "value": "dbfa8ffe0233bbf94177538a95324857cc23ebfc1fd2fa46ec7a39a069cbc07e916235cf1323626ecaad679c276e2960", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144578, "uuid": "1a80ac8a-6e3d-4bf2-b164-d60afe1b6dca", "value": "T185B49D01B6D2C1B2D57654300D26E775DEBCBD202836997BA3DA0D57FD70180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144578, "uuid": "b1f32d6c-d7f1-47d7-9da2-92b850f8f11b", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144578, "uuid": "1e41d7a7-7a7f-4050-99a9-fbace59ba96b", "value": "12288:qN9WLGVGUYcvqvvCNQzvCZQBm+sPZ66Sw:qN9sGV5YYqzvCZQBmtZ1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144578, "uuid": "ec40fe93-822b-4699-8554-ec3742f8cd58", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144578, "uuid": "be287b67-c0d4-42f5-95af-38961778a9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144578, "uuid": "fd021908-1581-40bc-abbf-0b6a7aa1cbb5", "value": "4e3c3570d344cbd5cbe17694c8fcb740935539e2c8376ebb60f9fea6c6b30003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a2e9cb-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150454, "uuid": "a05aa4a8-e2d8-4cf5-a241-72fcc85cf130", "comment": "Malware payload (Rhadamanthys)", "value": "af9f2930fa8773ad72066c3e6c208c79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150454, "uuid": "b22b128b-6a2e-4ba0-968e-41d67c7f4030", "comment": "Malware payload (Rhadamanthys)", "value": "4e69c9e7ef2250f9d004fdbffb8f3e7f13a40911c7a95f392310c434a7085280", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150454, "uuid": "099678b9-d6a8-4123-92c0-f802aac45b43", "comment": "Malware payload (Rhadamanthys)", "value": "f7d688a66c56df4b500ac71d1f93afdcdfd9aa8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150454, "uuid": "ae0408f3-d713-4a78-b361-eb07c21af33a", "comment": "Malware payload (Rhadamanthys)", "value": "5b62df14e0135acc4cb5d6ca25be8903b48592df35a102eca5636fb7c716e4f96cc2f14cf208ba318aa4a96ba74fc9ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150454, "uuid": "e91e9911-0b1c-4c89-8f34-7f5a7662a36d", "value": "T1FFA3F8596E416CB020562C047DD1C0AE449FED4398EBE67AF81A734EB4BE32C51FA6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150454, "uuid": "a80ef087-3d8b-4470-961b-0abfa0cff637", "value": "1536:GDB7eKg200aWprDrK4eCpf8JhAA2aRr476BkQWJ+aY:GDB7b0q/bPU476BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150454, "uuid": "786785f2-8fb2-4b21-98c8-ef7216e2a87c", "value": 103966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150454, "uuid": "38568d0d-6dd0-4c61-b89a-f6b380ed6f0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150454, "uuid": "94042eae-efb2-4c17-96f3-0164c45a3f21", "value": "invoice-1637482117.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2805a8f-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761134856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134856, "uuid": "dbccf42f-ca6b-427e-9694-b26022c0b259", "comment": "Malware payload (Rhadamanthys)", "value": "1ce9392bb065c76cc0a04ef6b369f1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134856, "uuid": "3636b204-a01c-4adf-ba53-2e5cc6234fe2", "comment": "Malware payload (Rhadamanthys)", "value": "4e98e9c1660fc47d62d53d06279b856adfff9a37ca1970b84f07075cee66ed3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134856, "uuid": "819c1b82-fce2-474a-bf49-14f8b58c8ee0", "comment": "Malware payload (Rhadamanthys)", "value": "e5099dc55ce40465a2603a1d0507b8d82f02fef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134856, "uuid": "601b301a-0d11-431e-afda-d84b965574e9", "comment": "Malware payload (Rhadamanthys)", "value": "e50c7f2cccdced988287c3b5e9ecc3882cb65d29cd90454b5b7d5bad620855a2f8ff4fe7a0d443f0a1685ac2e1146627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134856, "uuid": "879f31fd-1ca4-48b6-bb9e-54489af1c95f", "value": "T1D775231254E80432D4E51BB025FD9167AB763D928F7E834F26DCAE9F08626D8A57033F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134856, "uuid": "20914583-4b09-44c0-a397-5fad6080706b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134856, "uuid": "b3f0e244-e7b3-43ff-87b3-9d48fcbacf43", "value": "49152:KYiEBuNDYEkU0eokKllD9ei+MyJq0UsK7DCF:KYirDH0ejKl56s0UF7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134856, "uuid": "b483c434-404a-4fad-b1be-263d251f9dc8", "value": 1682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134856, "uuid": "9b7b7555-9f28-4472-a2bc-6aa3634a4a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134856, "uuid": "f13f9c02-924a-40de-beef-800cc377d1f6", "value": "1ce9392bb065c76cc0a04ef6b369f1c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a05e1ea-af0a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761111944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111944, "uuid": "2841197f-9960-4e06-8266-b0948a637a3b", "comment": "Malware payload (Mirai)", "value": "bd909c78b5d4de98e142c845423567cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111944, "uuid": "3a84d41f-6b7c-4ee1-aa15-4a0c57d7e0a9", "comment": "Malware payload (Mirai)", "value": "4f669c1cbeb5af4666b3edde408181ba77426ada97ec9a43fbcd291450a4b3cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111944, "uuid": "d9a91d8d-8047-4221-8243-7ad5fa7cc8b9", "comment": "Malware payload (Mirai)", "value": "e2687fa1e8a1682386e3448dc7aa56d42a507999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111944, "uuid": "205dd23e-3bd4-4f23-8702-74faf0463ce5", "comment": "Malware payload (Mirai)", "value": "c320f51fdf0325a59acec3a4b3cec6bdcc34c892b484e8e97f6303f4dff1c346a68bdc7e1abbf3a1b009e2927c069547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111944, "uuid": "29dc6eb0-320a-46bd-be35-5f8cce23e551", "value": "T1FCB32A86B895DA21C6C656BBFF4F428D3716539CE3DE3203CD285F6036CB55A0E3A066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111944, "uuid": "cf3b0bc6-d27c-472a-9bc7-f0a239d789ef", "value": "3072:33tTazO6lJd9ly0Lpsy5T7baOFNT8m6SrMovcVqlPyeFpSWF4CaBIcJnzW:33Ya6lJd9ly0LpZ5/bvR8m6S1v/qQB4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111944, "uuid": "fb5d64ef-cbad-4925-9adc-e81615c28893", "value": 115296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111944, "uuid": "11ce445f-23b7-4f52-8d0d-6cedc960543d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111944, "uuid": "b44fa645-4f20-4e92-a200-1860b6fd792d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325f53c4-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150532, "uuid": "82a18cfa-b630-4c39-9c56-4faf2a5b6d00", "comment": "Malware payload (Rhadamanthys)", "value": "3cd021c6371280a26205a736ecee6911", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150532, "uuid": "76659d21-ecb2-44ab-ab4a-c9a6c9570555", "comment": "Malware payload (Rhadamanthys)", "value": "50ebdcac1dab3746e85641dbf80ff96c0b7e8dbe24c5b757512637e86dfac944", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150532, "uuid": "2d38cd5f-683a-4b3f-92c6-3786631131d0", "comment": "Malware payload (Rhadamanthys)", "value": "b973c72b1703be4a1809baeb00065f123409d5c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150532, "uuid": "5be52ca5-f0c4-49b0-875d-f875d5965c45", "comment": "Malware payload (Rhadamanthys)", "value": "6c3c263f4d2858d7181f3fdf1aa5b84f9f9389d774f3aee5d04fd47aef184724c0e53eaae08f452c4b48ce78f3e22922", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150532, "uuid": "ff62f1eb-b46f-4c89-ae6c-0c2dcebe9123", "value": "T153A3F6068903E8B4C4B2965CACD782E1D39D0ACEBC1B985D983BFFA056967033D45BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150532, "uuid": "eabd99e3-5f82-4e80-bc25-097113fc0d89", "value": "1536:GDB7eKg20oyl4CxouX9YEMQGHx4CRWORkyCdnFm3nyjosxQh1yT1xEqEK5nMriXn:GDB7b02Dj2UAK6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150532, "uuid": "50dee867-494b-44dc-92d3-1f966275b9e1", "value": 105328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150532, "uuid": "3798e06b-770a-462e-924a-690bc6d9c41a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150532, "uuid": "ff196bb4-8e63-45d7-9ee7-0a0406e4b3f2", "value": "invoice-1637482117.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09d9145-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130960, "uuid": "85741e44-fa9f-4314-97af-e83a0d58508d", "comment": "Malware payload (Mirai)", "value": "5f3213e8170fbd637324225b776838e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130960, "uuid": "60ed77e7-bf7f-4f44-85f1-18f444597f56", "comment": "Malware payload (Mirai)", "value": "518d417aa2020ae4d54843a465cf6213b443184a4f394cd063907b20a7ddd7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130960, "uuid": "10651142-d6d8-457c-ac34-53b8c15d44a4", "comment": "Malware payload (Mirai)", "value": "435742017aee412e1c83316b64c2d817519e98e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130960, "uuid": "a718fead-cb4b-4172-bf98-5ab2ff48f718", "comment": "Malware payload (Mirai)", "value": "88a2b48f127f25181d70d054a983c0b45ecad8318f822862f3986d30cd5276b244f3a6b3a20241eba1c583448c05e9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130960, "uuid": "ef08a12c-be52-4f23-9cf6-3b95dc69055c", "value": "T102335CC5F543DBB5D84204703076EF339E3AE6FA215DDA87E3E5A532AC43502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130960, "uuid": "e83b41c5-c1ca-4115-9e79-e1b5f0c334da", "value": "768:ytYRSjaQ9DaZ/oJaExakbMqu8iKvkvKy+hplmTm/4RsvKQLDJsgMjz:WYRSjaCu1waPSvly+hjmq/4G3LNsgMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130960, "uuid": "0a70bbf1-c0ff-4de7-b7c8-bf5c233b718e", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130960, "uuid": "0f8a5e9c-8aa9-4637-b038-5279afc08f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130960, "uuid": "af18d891-abea-43e2-8de8-32b0aad354ee", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7588c52-aeed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1761099618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761099618, "uuid": "850ab3d0-5d50-4757-949c-aaf690efecb4", "comment": "Malware payload (Blackmoon)", "value": "743c19dd658cd110d99b921eca1a3fd3", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761099618, "uuid": "faed3995-daae-4512-8391-ed83d8bd6cca", "comment": "Malware payload (Blackmoon)", "value": "518e5e89c6a9503c974d3232609f160b96a12fcaf57b812629bd667d1cbf0c93", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761099618, "uuid": "527c4c0d-ee53-40c1-98fb-517e659dc392", "comment": "Malware payload (Blackmoon)", "value": "de2d48f18ce5d6a888982b8b82c1cbcee505d524", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761099618, "uuid": "3dfc19d0-2d58-4afa-981e-89d4ac4621b7", "comment": "Malware payload (Blackmoon)", "value": "d424ed01582b1cbdb58308ea9b9a59e9e1c8e3ca9a15dcbef7d2abf2ee58746b9899c34b9cae870a7491b75613cd282e", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761099618, "uuid": "ae322914-d009-4706-9fd7-c8eb2eaa5abf", "value": "T16486333386AA4505D4EACC3EC22BBDD571F7527AC2C2E4B07597ACC129329F5E303996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761099618, "uuid": "0b862604-b9ff-4561-af4b-b754c9000bfd", "value": "59d5fe9df43b9206f1f49acc623ab6ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761099618, "uuid": "bb2cf6c6-2c25-4532-9fa5-86f9e7d936dd", "value": "196608:AhVjUd9oBdkxVh4Os2V/fvN8J3u+RVrUC:OVIdmBLeRfe3rRVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761099618, "uuid": "38adcd12-132b-4d8b-94ca-40ed41ebaa25", "value": 8409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761099618, "uuid": "9c82e80b-eaf8-4684-959e-d8f976826e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761099618, "uuid": "96414a99-886b-4ff2-8dc0-a39067d5a734", "value": "SecuriteInfo.com.Win32.MalwareX-gen.42811166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918f84c7-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761121056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121056, "uuid": "fe82aa13-0f55-420a-a83d-9ac237195971", "comment": "Malware payload", "value": "5bfbfe8380fed6b81af7e1a2c51d5fb4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121056, "uuid": "5573d190-ec77-46ac-8ad4-b28864b36c76", "comment": "Malware payload", "value": "51aaa8846bd3bcb529cfc6f868add40c19839d692d9ed218c97fb58be39fcc7b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121056, "uuid": "10ae65c5-d7d9-43f9-8e63-d7d0bbfaae35", "comment": "Malware payload", "value": "07399729d3533a76936c6101918797765f9716ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121056, "uuid": "ff7ef3c7-a732-46c4-9afd-1ed07c7d298f", "comment": "Malware payload", "value": "be6c08a872fcf95e2314af09f6dc5c32c9a780cfffdbf8acfcffebf37f2619523232dfd58b843592ecb1a2d60af4e76b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121056, "uuid": "1a3f46c6-7280-4d4b-9ede-73766c4b7aa7", "value": "T16E6423680BCB6247D3D382FC866C9961BBFA3703505B2275F7B4C24DDE5836A1237649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121056, "uuid": "c0bdb74a-e893-4472-a20d-34087cfe10bd", "value": "6144:zJf9KPuThcPhAeXsiz6Q6lFmlLU8WhM2LWq4YHP8QNB/1wMs/x5hLJziD:P2tsiilF4LUTJLFHUa/+MspfgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761121056, "uuid": "13a17ab9-0f8e-4412-bc9b-963368320418", "value": 320490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761121056, "uuid": "45598ebb-c72f-480b-9da8-b7fd52bb0f3d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121056, "uuid": "0115ab88-5d43-47cb-9d0d-c1fb27215136", "value": "aaaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3c5b47-af86-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761165180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165180, "uuid": "f0db07a1-e646-4bfe-84dc-659e195da374", "comment": "Malware payload (Mirai)", "value": "0c52d9feb6b7652389095c3e9fb3a9b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165180, "uuid": "ad5bf8d6-7fd2-4e08-9239-ffbc5a194cfd", "comment": "Malware payload (Mirai)", "value": "520ab8e7047db9e2b7cb56baeb552ff066537bdab7ba8f7053a2a7c5c4679c76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165180, "uuid": "7b034a4f-8002-4c2e-8c61-981f73c48e46", "comment": "Malware payload (Mirai)", "value": "7efc8393397b540bec8fc3a4579bc78f07e072a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761165180, "uuid": "303240bd-2afb-4b62-93f2-6754c5f7ede2", "comment": "Malware payload (Mirai)", "value": "e9984a1e663b28b700e9c49b0f64c9e64c53c73dc95f36422e92beaa9b8258d5b5fadb0237edd39891b2ccc1fd0773f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165180, "uuid": "2d1f8d6a-f959-4520-9ac6-e87eb048c6da", "value": "T1FEA312063731A361C6370827A8341E6B31DD8176FA77D1239B27F87E1BFF511A0A49A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165180, "uuid": "1892e5b7-2faf-4754-b43c-b220ebe596da", "value": "1536:r1D5Xl4ZnBBHsfxwVFzI/goveRTjGzpRjPuUC8/h1VJLa7WKiJ6VL/jMopgeAEGE:xDZlcZsfi8obRuzfa8/V1dFqL/PKJLwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761165180, "uuid": "93f76e5b-4059-4d98-bf7d-060bb2caab8c", "value": 98192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761165180, "uuid": "c7ae478a-c35c-4f95-bc6b-2fbb44950913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761165180, "uuid": "3b2de9a8-4150-4d24-8e1a-2b26510afcde", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab061047-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761149875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149875, "uuid": "b36817e6-b5b9-4102-ad8c-25b85f7bdf52", "comment": "Malware payload (Mirai)", "value": "cb83857640781e415200ddafa9ba92bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149875, "uuid": "6f5419fe-8966-430f-8ad8-cacfe9ad9d39", "comment": "Malware payload (Mirai)", "value": "52cd19c92b4ca3471003e5506bc5a4d5836f0ede7c1d8ec4b095040c27fbb763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149875, "uuid": "0f0c7fd7-f3ca-4665-b401-fbb82a2daa52", "comment": "Malware payload (Mirai)", "value": "01fb955eef5774a23d7b2965ad1171c0f82c0a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149875, "uuid": "b2cde520-a783-413b-a9b5-501b5b227205", "comment": "Malware payload (Mirai)", "value": "000b674f85c629031f8b912f7f978854e967a85983669d372a413af8742b2a326c16881ea0f06d6a1de3182804d47ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149875, "uuid": "1c4b3b09-b81e-4a82-a59a-a20a948cfa36", "value": "T10B042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149875, "uuid": "64e80206-17bc-4efd-9b0f-945a2f44a08a", "value": "3072:O8/WsthjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/7lvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149875, "uuid": "69175314-efa1-4d86-8ca2-07bc3aead6d1", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149875, "uuid": "c3d087ec-87fa-48cb-a0bb-9363d81ab396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149875, "uuid": "a5988e44-ba9d-445e-9886-3895ac05fc43", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fd089f-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150572, "uuid": "92789674-beb4-4b1d-b19d-4925a55a97e8", "comment": "Malware payload (Rhadamanthys)", "value": "6ad66855103d2a07dd69aaabf2ec6ce5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150572, "uuid": "353d7265-ff19-4e16-9db1-ac29ce60267e", "comment": "Malware payload (Rhadamanthys)", "value": "52f8999c9fe992ce9afb6a97f4a064236481cd011b7283355495d4343ac4fc77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150572, "uuid": "d9ea64d7-85fb-4312-8fb0-6949cf8186c6", "comment": "Malware payload (Rhadamanthys)", "value": "8e623430ad22690d665dce2cf44966a34ef6510d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150572, "uuid": "7d8c3d07-837e-4f4f-a235-a4c10b10ff3a", "comment": "Malware payload (Rhadamanthys)", "value": "15c4073e1f0734aec2236b3547d744d6e8e972a2f38adad6b9dc6519c65e0fb5c2fda508c5cba711cfdd0dc855563040", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150572, "uuid": "a6b17d27-ddf8-4e3c-8161-bbd83e175415", "value": "T143930BC09D70EDF92D0F3B669EBC98E62D07E8361AEB4709D446BB043248E561C751DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150572, "uuid": "02c81e21-b309-478c-bc42-e5b243a75155", "value": "1536:GDB7eKg20xXJrUrB9ay2A3ft6BkQWJ+aY:GDB7b0xXp6nDpft6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150572, "uuid": "072458ee-02df-49b2-9198-0afad34414d4", "value": 96106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150572, "uuid": "e6753558-da3b-4129-ba27-ff65ca5dad7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150572, "uuid": "b632c169-fb1d-4c48-bf67-52d7b2a9d47f", "value": "invoice-1637482117.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46fa4a7-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150428, "uuid": "a6d7c264-c4ab-4bfa-a750-f50cc8f658d8", "comment": "Malware payload (Rhadamanthys)", "value": "a29b288100074cebcc021ec355f0f920", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150428, "uuid": "e7bd8abf-0913-41ff-90ee-8fad495dce28", "comment": "Malware payload (Rhadamanthys)", "value": "535f0477c18131248283d572cec8d0af779b8704e59ba9b9ec2943ae0aa56e07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150428, "uuid": "a32942f8-af51-4992-96f4-ccba3d416a8d", "comment": "Malware payload (Rhadamanthys)", "value": "8db9200ddc99cfff94d791575fc98cb2a4bb43b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150428, "uuid": "bbe5f916-b8ee-4e67-a74d-df8ecf795f3b", "comment": "Malware payload (Rhadamanthys)", "value": "c48bc533be94c2da8031fde25aa0a22e0e0084b2fdfc49725f6272cf7f17bbeedc64261f89b52569938425e6352cd0a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150428, "uuid": "e7ec9dba-919d-4ef4-b4a1-83c8ff41880b", "value": "T17AA319107407D35998A7B7133C474072DD3688638162A72CE150F6A3EDBE768A8B6EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150428, "uuid": "3d1db1a2-283d-4bca-a444-1015cbb287dc", "value": "1536:GDB7eKg20q494rrrw8PcrV1hc0AHnscg76BkQWJ+aY:GDB7b0qPXDesg76BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150428, "uuid": "6dc672c5-3371-4204-9dfb-70246d4dfacb", "value": 105377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150428, "uuid": "64017b35-091d-4aea-b61c-6be7666185f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150428, "uuid": "9c92d8a2-f91e-4af9-966c-ae132a4723c4", "value": "invoice-1637482117.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680fdd11-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761137737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137737, "uuid": "788495f5-5c64-4a4b-aa6c-952a2d9359ac", "comment": "Malware payload (Mirai)", "value": "0366f7f3a0044be6dd77eb7e7b1955e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137737, "uuid": "13a37e13-fd44-4c13-8afb-40aa645ac09b", "comment": "Malware payload (Mirai)", "value": "54460917371d61e30345ede43e774187ae600a2ed499077dd8b92e893f506d9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137737, "uuid": "e6a8349f-2097-4055-8f02-ca33fbdf90bf", "comment": "Malware payload (Mirai)", "value": "a87c333e66a35b4c70e27221d54c6c98793b61b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137737, "uuid": "a6be813a-7ec3-4a0e-9e9b-ce2f566c307c", "comment": "Malware payload (Mirai)", "value": "7f1e3e6c19a1404e8a130aca9de9951a23b226656dba3ecd149b47cd243ac241456b35eb357004d9692beaeb8eab789f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137737, "uuid": "02708dbc-5791-4f23-957f-97132c66b89c", "value": "T1C3D32A06730C0A47D2632EB03A3F67E197AF9AC121E4F640355FAB8A95B1D335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137737, "uuid": "3a68e13e-332f-499f-8c5d-042d2c97c7c0", "value": "1536:9roGHNTotN+hIBUiCxfytyteQYXZLarw0o7lT0JvAhhnrZ+5BQfqY00VFUu:nOJUiCxJtG6w97lThgsPUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137737, "uuid": "a524c197-466e-4ca6-8acf-85f70bdf1955", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137737, "uuid": "e79bbef8-5bae-44be-aded-e2bac233053a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137737, "uuid": "8f5fbd86-9e84-4362-86a0-d6fdc3e674fb", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db706749-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138360, "uuid": "afeb5b00-571d-423a-9118-bb0bb9ff2de7", "comment": "Malware payload", "value": "3302e7c8e2d75524560eacb2b033dbe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138360, "uuid": "ea29316f-f2f5-4ef9-9461-7d807b4fcbfc", "comment": "Malware payload", "value": "54b7c4ce445084297cdc4e23cc1ecd096d68957d2be8b50669d2a23e7de91b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138360, "uuid": "954ef66d-70a4-40ac-afce-140970d51c3e", "comment": "Malware payload", "value": "474abcd09b4496d8671904379242b2d81a1db674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138360, "uuid": "37b69059-ba88-4f1e-9b9e-16d235059cb4", "comment": "Malware payload", "value": "202a5a1795997751db9d1061c2a531dbbf5af424a3fc180cb320d35f9300ce705c4095fbf9f2fb2e7de3e30fb7117630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138360, "uuid": "a8f8f6a7-7c04-4e0c-bc7e-020d6c93e18c", "value": "T1E3F412296B9BDD02CCA22FB146A0F37622689E4DE520D2139FFD7DD7B079F122859341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138360, "uuid": "da7e406b-15d4-4247-8e6e-16fdba88ff5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138360, "uuid": "43bc037d-c46f-425b-b006-3ad06ead8027", "value": "12288:xXcaCANblvYd60GiJHFqdFuGFyPVZvZ7xeLrFi78K5YEMBUmmIJ3oYK:6aCEtE60GiJHFqKwCrh7xea88YEMOmX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138360, "uuid": "6a15afc3-79a0-4056-892b-7add7ef9d08b", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138360, "uuid": "ed1cf9b4-f6f1-4a7d-bbb4-42a04f6ff7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138360, "uuid": "09553eb8-2c08-422b-a0a8-a33861fe442f", "value": "FIYAT TALEBI TALEP NO 22675 CANSAN METALURJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c64cb0-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761137274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "f436752c-a400-4212-94c1-155218d311d6", "comment": "Malware payload (RemcosRAT)", "value": "30ba7126aaf87ca43fe6f576f8db4a09", "object_relation": "md5", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "ef15899c-d732-4e48-8ef7-6b6ca42580dc", "comment": "Malware payload (RemcosRAT)", "value": "54bac2856701e27534709111dda8489ff7b49f1fc45209620722292c00ded183", "object_relation": "sha256", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "33587079-901e-45b3-afb8-e2fbbabd25cd", "comment": "Malware payload (RemcosRAT)", "value": "e3af8a6293254e04c79df7698981c12ac2b5d733", "object_relation": "sha1", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "adbb531e-967f-427c-8b58-235070b74b7c", "comment": "Malware payload (RemcosRAT)", "value": "70bced65f6de44f2f19521435094f1a846461f715eca6eda4bf4068069afc7c627c795bae227b0d8057cf1ec2dcc9127", "object_relation": "sha3-384", "Tag": [ { "name": "4514944459", "colour": "#9FA767", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "f715742a-38d9-4c97-898a-06951e9e3be2", "value": "T1E9B1F77323A5ED754849B6666F49A10E2C34C3C3B01488AC50E8E62AF9281A42B3D79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "2e63b243-1da3-4ac5-964d-ad4910c943a2", "value": "96:PBVyHCcLTUZ7yzCRIElMyxLGQzVs6bPgI6TsHGGunMt5m11/nf3XK9ntAPBG4:PLylLTIppvasR2MKPfHVPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137274, "uuid": "3b800021-c2e6-4b16-a9fa-ff0becf2f932", "value": 5374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137274, "uuid": "dfc9c262-d7a2-468b-bd26-fcd6ad89cb3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "eadeddad-17a6-49a1-882c-8ea6409570f6", "value": "ORDINE D'ACQUISTO-No4514944459.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d08028d-af56-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761144483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144483, "uuid": "5e340e28-b0ce-4386-a29f-fcaebe6690bc", "comment": "Malware payload (RemcosRAT)", "value": "85fe689965fdefc4244e3eafd9df48e4", "object_relation": "md5", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144483, "uuid": "2c34ea5b-397c-474e-b6d5-1e3f003efced", "comment": "Malware payload (RemcosRAT)", "value": "54d28d6024760e5015b28a36f8fd3ef7197f955b457f12f2225ad6627ed7d81c", "object_relation": "sha256", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144483, "uuid": "9d38fa87-732d-45e2-9083-2828bbdfecf9", "comment": "Malware payload (RemcosRAT)", "value": "ea5863a696b5e9b6eef6ccd7957063f37686a7ae", "object_relation": "sha1", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144483, "uuid": "a1bd52bd-7317-4b02-8d6f-5d33c78be1de", "comment": "Malware payload (RemcosRAT)", "value": "ee278df27c6636611842f2132af731db0ced18e83a1d1d4fb5a48a4707334bab3664f02ef39b7ec976965ac60a5cd4d5", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144483, "uuid": "2751fc1a-c87f-4ce7-87ed-70e541cb176c", "value": "T1FE713CD20F87463F10C16401929BB5EEFCA579FFA46C73EB87A061645DC2A0C3B13262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144483, "uuid": "69c6913e-9ea9-41c8-bbdd-6db85cc14c61", "value": "48:ZI3Xrak1++wI+CScWc7LzLchJPX15cZLNCooYZvNbQZ+kjncrLcpCneWKNLEftMu:ZIra3P7SXoPwzJ2/JX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144483, "uuid": "c8cf37d7-68d7-416c-b586-f4fbdab894c8", "value": 3562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144483, "uuid": "85a1939a-a5d5-4963-8575-d0e0cf50e467", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144483, "uuid": "d444558e-0ce9-4ca1-83ce-ef27e497e4e8", "value": "54d28d6024760e5015b28a36f8fd3ef7197f955b457f12f2225ad6627ed7d81c.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a09214-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150459, "uuid": "2a84dc7a-a1fc-438e-bbdb-b78d10ea4409", "comment": "Malware payload (Rhadamanthys)", "value": "9a7840c9cc751b0d588938addaf20f8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150459, "uuid": "ab0ce628-ce32-4f6b-810f-dc103fbc392b", "comment": "Malware payload (Rhadamanthys)", "value": "55be230b1d48f24cfcf2a49871e99ac64408cc5229e2b727ed76079791e56698", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150459, "uuid": "29581a71-0b45-45b7-b904-0b6550b6f45f", "comment": "Malware payload (Rhadamanthys)", "value": "1687df174db4a4c36d339d8f9d7da6819b7e6f9d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150459, "uuid": "814dccdd-066e-4c5b-ab8c-bdde9e0e4558", "comment": "Malware payload (Rhadamanthys)", "value": "e055c2cb9662dec4e81117271885d9df94613ef6c6219405ee74e615f68417de430956f41b338b5e1334e6db77539acf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150459, "uuid": "d2baf006-4402-4721-b4d6-5fdb7f3b038b", "value": "T13CB31A801E12BDA0A3DB8EF06F611C5BD71B4BA74949D4424496FBA630F4C5E8BF84DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150459, "uuid": "37abf125-dea3-4d39-9c7c-ac22eda4df8a", "value": "3072:GDB7b0Zdgh5rOneBgfSafvA6WJOQsq0H8E78U7vXLTKfOKNAybOlf1LTX8pEGfBG:0mdgh5rOneBgfSafvA6WJOQsq0H8E78+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150459, "uuid": "05657138-8ad4-4862-beb8-0fed999c8f44", "value": 107950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150459, "uuid": "3004d346-d8c8-4585-b845-a008d95b3dfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150459, "uuid": "644566ec-2d18-4b1e-98b5-e692e30499df", "value": "invoice-1637482117.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0edac9e-af5d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761147738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147738, "uuid": "d922abef-5c89-420f-b245-1d3dbda56ec9", "comment": "Malware payload", "value": "6b685229adec2a36160da066f345dffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147738, "uuid": "9faf2fc0-5211-4a8e-9714-645531d61509", "comment": "Malware payload", "value": "56c23e14dca3c2faa010abf7af0e43b89204f315a95197dd4d2815b17d5381e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147738, "uuid": "9b39a323-5b19-4362-b99b-1d02c0fdf1ee", "comment": "Malware payload", "value": "5f023f616c95ef03e586888825f2f2d31b54b69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147738, "uuid": "0f7945ee-3d1c-4bdb-bb9f-03eb4e68ef47", "comment": "Malware payload", "value": "e7f7d6e041f93220adbf558d476415cab385dffb8d1174fdbb3a2b6623c5b5155b97e091a540ee2d9b957e0caf682fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147738, "uuid": "895e1065-df80-44e1-9711-65dc2aea7bec", "value": "T12792C61A7BA384ADC60AC27991F7877159B0BC0904246FBE8235F2B33F75964A73D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147738, "uuid": "02d8c857-fb12-4e98-be3e-7935a82f01cf", "value": "3918be224dd8d00a55923c4f5c66c1c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147738, "uuid": "1573fb65-474b-4596-af7a-694b23852ed3", "value": "192:9vwwvTAhei17cTZRToGfUwbAchfsY8W7qpOZDwqswKKEIPuXkH6W8WCXCiYCUK5J:9vZIafBqW7n99FKXkuX35LzzVh2pLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761147738, "uuid": "0c6ec915-940a-4755-ae84-3b9a28d6af29", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761147738, "uuid": "1acd5dff-4e46-4f04-86ce-29296cbf1c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147738, "uuid": "1c048cb6-94ae-4809-8887-595295dbc7fa", "value": "56c23e14dca3c2faa010abf7af0e43b89204f315a95197dd4d2815b17d5381e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb244ee0-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761113395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113395, "uuid": "a7d4673d-8c4f-4473-8ef9-ab019bf18937", "comment": "Malware payload (AgentTesla)", "value": "161fffc1d03a03639413f5c6b54f329d", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113395, "uuid": "58fa9e15-ea55-4019-aa46-09f43323f850", "comment": "Malware payload (AgentTesla)", "value": "56d8684d3cd70838517f4c3aa4e5cdb8f3b855f61a30e96064d601254d01be10", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113395, "uuid": "f2df60ed-218c-4554-ac3d-577f8feba6f4", "comment": "Malware payload (AgentTesla)", "value": "b85016677b4f872d00378be402151934788def3a", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113395, "uuid": "c8a2b7fc-ed0a-45ca-85be-2f5a3dfb39e8", "comment": "Malware payload (AgentTesla)", "value": "5cf819c6cfb8b95784c89d2d930857ff5840e5df6b655c72f149b5b6ffdf0621802c8b0692a98ef350f5df98321a2a75", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113395, "uuid": "8a3c1030-606b-4337-9c13-2f8a8063e236", "value": "T12E1523FB67E60D2DD07D80BC14962629437BC1CA5CB33B8BAA62E90CDA661014F4773D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113395, "uuid": "e091fbd1-8bce-4e25-8572-e4f6cc8f0dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113395, "uuid": "30aa521b-4bfc-45bc-b164-41f82f7681b7", "value": "12288:worustDoZq1k3OlfwMIG/PYFnCAwAAB636pzouQ2O7w9erKOUegV7R9Jmaa:Hr43Fk8wH63602J9e+Dgaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113395, "uuid": "40d70e1b-c044-49f3-970b-da41557336e5", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113395, "uuid": "b9b335a1-4005-4c22-862d-d2ab44cbdbc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113395, "uuid": "00508eab-ca8d-4215-b229-3e2a5db8abfc", "value": "56d8684d3cd70838517f4c3aa4e5cdb8f3b855f61a30e96064d601254d01be10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68813895-af49-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761139026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139026, "uuid": "dc2aa469-368f-43a1-8395-b2a258724b4a", "comment": "Malware payload (AsyncRAT)", "value": "6ecf205b467239cd68e912ef34f360b9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139026, "uuid": "c757dbef-6716-47b3-8ce7-e0e90a621f1a", "comment": "Malware payload (AsyncRAT)", "value": "56ec20d049cd552929c86811fa90cf3f78d0f622dc888432da501dc1f48d4e44", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139026, "uuid": "9bdf2a30-395e-485f-b296-c16bbdaa9f63", "comment": "Malware payload (AsyncRAT)", "value": "323442371dfa7d862a982049a34e7e7cb36a091b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139026, "uuid": "464a4acd-caca-4695-bfe6-128ea50698a1", "comment": "Malware payload (AsyncRAT)", "value": "d241502ed68a2d5fa33b3ea1660e28269c96d4dbf420405c90a04925556ebc2a37cff30ccf55690216d047fd108fe553", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139026, "uuid": "4d56b7ae-4ff7-4f59-acc7-3bd0a8be4707", "value": "T124175C92AAC44D07D17F4FFC46B1EC8141B9ED1AAD82ADC65EC1F16E7039F68A108B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139026, "uuid": "68d6c6d6-fc42-45f0-94ab-6cd19d3ba6f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139026, "uuid": "55f8bd83-911a-44f3-8dfc-e52b04ca1d34", "value": "6144:+uvtP5FDlOvUqjZCwOoItlasMWGYsb7r5oqxTa6zXGICI5Zw6C1rzR9c7hw1/pn8:lvtP5BmjZtvItWWGNyI5FC1rzRW21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139026, "uuid": "64606412-db16-4a94-a0ef-ad6b9772ae12", "value": 19922944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139026, "uuid": "c7b0bbe7-9577-44c1-b63e-fb3881391d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139026, "uuid": "660a3350-8c76-417b-b2f9-f45e3ae6d925", "value": "SecuriteInfo.com.Trojan.PackedNET.1603.30803.10205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98abfcf-af61-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149470, "uuid": "02b279a0-f741-4c8c-9509-07f52e96a765", "comment": "Malware payload", "value": "49b8c7bdf51dc3bdda91e2da64191d3a", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "cpsvfd-com", "colour": "#8DC236", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149470, "uuid": "39447c69-5b93-43a2-9a99-57d802ab53d5", "comment": "Malware payload", "value": "57fd776598ff331aea5318dd21e976fec224b604537b358898d10763adea0a8b", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "cpsvfd-com", "colour": "#8DC236", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149470, "uuid": "69c1fbdd-2aac-499f-972a-1793cef1afe9", "comment": "Malware payload", "value": "9814f07b78bb8ae1ac50408c2f40929ff8e4f887", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "cpsvfd-com", "colour": "#8DC236", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149470, "uuid": "ee6b57ee-2d70-4bd8-82d9-681effd2d85b", "comment": "Malware payload", "value": "f036ca1081b93598788daa9611dc7f07f4a1e1cfaa392f6ac994fcec41f95941204a5c5a4650bc0d2a87f2bc159f514d", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "cpsvfd-com", "colour": "#8DC236", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149470, "uuid": "4ad64e94-82d6-4b68-b421-b67beb8d477d", "value": "T103C08C17211C036D8E1D9204680D2A83D48A5088100E88FA60AE244427022B281C338C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149470, "uuid": "084c9d8c-4451-44ff-aeb0-d7e10cefbeb2", "value": "3:VSJJFI9IrFATH3x8XzYQKLGKI5QRwJAFCsxyxJoL7+u1MFIKcprxyxJoLf:s8qOLh8X0QmRw5sxyU+u1MFI3prxyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149470, "uuid": "a6f0d16c-b8b5-4401-9ac3-e46ba7bc41dd", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149470, "uuid": "fc3fb772-6f86-49ef-8187-d42ad2644c97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149470, "uuid": "7093833e-2220-4eaf-b701-e25dddef0d47", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee95a60-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761138339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138339, "uuid": "4cd95396-179f-49d7-8477-abd65f487fdd", "comment": "Malware payload (XWorm)", "value": "336388dbe238b1963e68cd1eb58ae2a0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138339, "uuid": "8ef6ca67-817a-4713-b5a5-9bca21680268", "comment": "Malware payload (XWorm)", "value": "581ccdedd0f1e52d4827a25038c0eeb4f3526cbcb430df2cb3f8607995805991", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138339, "uuid": "69dec531-05ff-405c-9c4f-bb6698654afe", "comment": "Malware payload (XWorm)", "value": "f5d2611acc442fac0fb280b1422d9dddf0fd6c26", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138339, "uuid": "d64a87aa-ec78-4405-8a49-0dafd7d2b388", "comment": "Malware payload (XWorm)", "value": "122948fe4073d685881d1918ce9aeacfe3965928404c675ebd4cd296b06d149385a9586b62b275e92592f4f1e900c004", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138339, "uuid": "0e39f63c-93e6-4f69-9f9e-cb7dcbdf5a10", "value": "T137D35F2B876EB883026B3087E5F53B7A1C4CF64EAE3169F897D204711B45631AB5F16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138339, "uuid": "3fa168c9-cb4c-4c22-8bfc-e9ab5bcfc3ad", "value": "3072:17akRzxdKfKlkVlbg3/MxpoaT7/N+9Soqf5w44og9kyfluJRHcxXYaxRya3eur4/:17lRzxdKfKceIRkEnwpqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138339, "uuid": "635c00ae-cff2-4ef3-b62e-9f08510e691d", "value": 136611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138339, "uuid": "1baa9d1a-9f9e-4cc0-b032-1b670ffae180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138339, "uuid": "59030210-c362-4d2d-87ca-83f47400e351", "value": "DEKONT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad45d12-af9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761174115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174115, "uuid": "a7e21c4a-be29-40b2-8e71-b9073e274a66", "comment": "Malware payload (Mirai)", "value": "e4aef9a165040fc03ac90b9c97fa7021", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174115, "uuid": "be136cb0-5b1f-461d-8614-4c31584d2fcd", "comment": "Malware payload (Mirai)", "value": "58d1c6a788de6932adaca1630296318bbd5a5d243c4467527706eeedfca60c60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174115, "uuid": "0674e582-f12b-4d4a-9706-aea826f7e86e", "comment": "Malware payload (Mirai)", "value": "75540460a802e016d84885d272ed354030844b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174115, "uuid": "9a786bb0-d09d-49fc-8bdf-1063bf45c9ae", "comment": "Malware payload (Mirai)", "value": "4574ec82cb2c10ceadfc63d991df3db41f8ba94c12beaca8411a4a5b0c07d63df818b7335d170eba7d30a8b5e7f551e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174115, "uuid": "66ccbff7-e58b-45c7-8f85-3c4b9a800e28", "value": "T124A32A56F8828B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174115, "uuid": "8a71f73a-2f8e-40d5-b289-d6555133050e", "value": "1536:dHnma2wfW/bfiGdLqHjC3PU45GjIZiY+garvVYTfuQr5MsQiAw60pZor7kw58YJo:8FwfKfVdLLh4Y+garvmyw1pZorwwKoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761174115, "uuid": "2f19bd11-f018-4cf2-bce2-e6c8dc516b05", "value": 101092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761174115, "uuid": "a8a1a5da-e623-494d-8afa-72458fa52ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174115, "uuid": "c568319c-90c4-49c6-9c65-082e611d6eed", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893b3d60-af6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761153255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153255, "uuid": "6c87bff2-f642-4358-b753-2da5c441df2a", "comment": "Malware payload (Mirai)", "value": "937bcf6d0e702b500ef52ef4e366b780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153255, "uuid": "e7121e06-bbd1-4d3b-9f72-3e4814e1d2d7", "comment": "Malware payload (Mirai)", "value": "59564e4bb2dd9073f66871afa5c868d52eafd35eee8f8320a5022e6f43075e7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153255, "uuid": "7d58e7a1-82a0-4873-9f69-2e75751b3dee", "comment": "Malware payload (Mirai)", "value": "2cfde8997be62395db9abbcb61e5fe5c96bb748e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153255, "uuid": "181a5a91-8e08-413b-a510-65f5af94b3b6", "comment": "Malware payload (Mirai)", "value": "0a53641e11b2b7ab1a820f4b9ad8d73795c2d1986353248562cd9d0511ca99be96f0ff5dc1222d236ca8e58f9785c758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153255, "uuid": "49de1616-d925-4899-9712-a5dc7bff42d4", "value": "T15334C50A6B519EF7D86FCD3705F9870125CCB04761A83B3B7674C62DB91AA0B49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153255, "uuid": "56e8aa1b-7cf4-4cc5-8c19-d7263d1ed410", "value": "3072:H93fNQPX+DUqLEBlJATpajxJrRFas2LJ4qiZDO:H93fa/+DUqLERuwjxFCl4qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761153255, "uuid": "e0edd84e-da52-4b3e-b863-ccc7819d9600", "value": 245144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761153255, "uuid": "f5ed8e44-c3f6-4b84-84f6-b5d6a97792d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153255, "uuid": "681a8686-05e5-4ed2-855a-465015a66dd8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d56de7e-af93-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761170710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170710, "uuid": "0efe4983-0e73-426a-85e8-6128bb498c75", "comment": "Malware payload (XWorm)", "value": "c91efed02e4d217bea3070aae4e1553f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170710, "uuid": "fe3648bf-6c79-4607-b93a-c3296b6dd817", "comment": "Malware payload (XWorm)", "value": "59750ab9e440131a2e01434226be0d8b39391420d3130a4bbe129b154360b691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170710, "uuid": "0c26ad57-8993-4e83-99e7-e125791d97df", "comment": "Malware payload (XWorm)", "value": "c2089fb811048f9f177d6224dfd0e56daaf94b83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170710, "uuid": "7e242298-1d90-4604-a657-25ca513a30fa", "comment": "Malware payload (XWorm)", "value": "971840f94f6c8e662d24bb610b0156b4f45cfb7aa682311562b697294f1b474b878791cccffe34c788e2bc17e17f6849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170710, "uuid": "496f342f-7886-4980-9b30-de33d874b1c6", "value": "T1E5E51A041418712EC2E5B3B10A214CDA6712B8049B5299DF77471FAFADD2EFD2AFBB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170710, "uuid": "f3ac8099-9c34-46e3-8f28-505a9f2fc260", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170710, "uuid": "16044775-6f29-4562-b4d3-8228577cdf83", "value": "49152:geBzmjfolv/E/hUf5/QQ/ZoUQNHYilIFPiwB06UhV2lRsMZ+hZ4VuiG+iyF5OWT1:gLBiIXQZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170710, "uuid": "ad4ea1ca-18fa-42b7-87f4-44388dae6f99", "value": 3081632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170710, "uuid": "efdb46c1-d876-4f54-8de1-e1eef0526e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170710, "uuid": "ec7f9e7c-1ee2-4bb1-be45-45962b9a04f7", "value": "59750ab9e440131a2e01434226be0d8b39391420d3130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c1fecb-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1761135606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135606, "uuid": "a08a767d-7c82-438b-bf8e-ccecdd8c2479", "comment": "Malware payload (Tofsee)", "value": "4f12de3efb647f8616b11e662cd18f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135606, "uuid": "11552534-abc5-47bd-b2d4-996057d74ebd", "comment": "Malware payload (Tofsee)", "value": "59e86e944f7eed1e774378c3eea29189f4b246da3713f8ebc2e0b5e4bdef751f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135606, "uuid": "d9f3507c-8ee5-411a-8eca-a32096631404", "comment": "Malware payload (Tofsee)", "value": "7cf6bf5aa155c684be1d39d357adfdd0b60dafbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135606, "uuid": "fa3f84b7-04dd-4235-8d4d-06d070e8419b", "comment": "Malware payload (Tofsee)", "value": "d21824008f6e19a82c4920dfff3950cf24be1bab04c241ee15f9addc91dd1804e5e18f5c1fc3f02cbaff1a4a1e71afbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135606, "uuid": "70d675b1-e34c-4fa0-bbb5-ff16389e1bc4", "value": "T1B9260266A24E563DE57659360E22EE10443FAEB4B11E4C6792F07E1CCF3B0512DBEA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135606, "uuid": "456d908d-bebb-4d03-a90a-054ff8a0358f", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135606, "uuid": "4b44f9cb-b07c-4799-a9f7-45d50b5f82fc", "value": "98304:qDbGGwUD85jfEstdO7u/tJgyHts9LTRNz/vDw4apF:qDbKUDI7E8/NkL/vs4mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135606, "uuid": "0cc2f7c2-da27-41bf-a657-8bd4918ae18a", "value": 4794038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135606, "uuid": "0def2fe6-190f-4051-bf57-e8b25286031b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135606, "uuid": "1ec77128-55e1-4394-8c44-b3df2ba9b046", "value": "4f12de3efb647f8616b11e662cd18f5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b4ed6c-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150538, "uuid": "f810dd1b-3dff-403d-a5d7-cde56f2fb5c5", "comment": "Malware payload (Rhadamanthys)", "value": "3391a288546e678c1f977ecd95b864e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150538, "uuid": "7df22603-4668-48ce-8444-220250043c36", "comment": "Malware payload (Rhadamanthys)", "value": "5b012b103d175a31e915375ca80783a3e8a51cd410960298df6074108c9edea2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150538, "uuid": "83ec20eb-9ef2-4e89-9858-57046f027df1", "comment": "Malware payload (Rhadamanthys)", "value": "e2c406048925c576a176506de1cb7605554fad7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150538, "uuid": "b586762e-accb-4a52-9f6f-a99d6614554f", "comment": "Malware payload (Rhadamanthys)", "value": "c3aec6e8b940c0e489bf12c5d84592cfb12d4068ab5826029d58babe10192b64c6974d163eda614fd6cc29a532a848d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150538, "uuid": "e99e3a1d-63cc-42d5-9390-cd7d5b941bb6", "value": "T16BA30A051512F2FD5047F2CD8AF662E4E4475018DA6ED20EA40FF7E61052BCAEA978FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150538, "uuid": "d0db8d93-13c9-4651-83f0-ec2808649ade", "value": "768:GDhd0i7J4sYKgY/CMNfWdFSNg8NsrX+brOReAH7YAjEqV/SLAuAAroQW+FF+Ec+p:GDB7eKg20vr+rORe2YAjpF6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150538, "uuid": "8404b43c-0dc9-4937-9ec5-39c7b199a110", "value": 104052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150538, "uuid": "08a6d74b-afaa-457d-9d6c-a469d97a35de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150538, "uuid": "f428dbf5-e85f-4683-b28e-38bd87c031a9", "value": "invoice-1637482117.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5442b8e-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761138323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138323, "uuid": "82b273fc-972d-4efe-a038-589b327cdd56", "comment": "Malware payload (MassLogger)", "value": "5dc084d8f3b33f2aa0a6b330e244d7b7", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138323, "uuid": "668550c1-c7ea-461b-b16e-09880ce0b5c8", "comment": "Malware payload (MassLogger)", "value": "5c220078935313e8b830c8de820a8c17213c0015805c565668d0b2d8a2edc193", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138323, "uuid": "76142fd7-5908-472a-8b99-bf805eb7d742", "comment": "Malware payload (MassLogger)", "value": "2a63f14096568e08f49d4f52085d9478474f39a5", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138323, "uuid": "d6868c86-cf3d-444e-8fc9-55797383f862", "comment": "Malware payload (MassLogger)", "value": "a4e8812459b83d465eb5ccc347fb20ee9aafb87cc197cf27de7a7068071a2a319ff9bf6034d46a1a248b5d999a5c1d6e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138323, "uuid": "4515acfb-bd9f-422e-97ae-866e49bb58e4", "value": "T1530529F237EF7A4B5A157759944D29580F5FC0241E83B6D8A0DB0BD8580F88B2AD0DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138323, "uuid": "4e6d7cda-fec3-451d-8d05-15030fa4d9b9", "value": "12288:wgoRvfUQ8CF065uJmxl5+PT0U4ZKhlpMj99IlLxlRr1nZXGIhS1KYwwu:wrmmF0651lgT0UlhQglNL1Unu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138323, "uuid": "7da17504-64f2-47f6-ae50-e80b622f1c27", "value": 841788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138323, "uuid": "9d47a4c9-7da1-466f-953f-1e020558166c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138323, "uuid": "a13c061e-a462-41c5-a556-94c515c5f69e", "value": "E-dekont.pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e55d33c-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150633, "uuid": "5c45c6d5-6996-48b5-b588-51fc615fb53b", "comment": "Malware payload (Rhadamanthys)", "value": "28ed61ad5d65fe85470b5560fdadabcf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150633, "uuid": "4cab2a60-e497-4468-aebc-0e3e15821999", "comment": "Malware payload (Rhadamanthys)", "value": "5c4d7b3c0e982e054c0fd8366c0b1471fca63c011f38ef72597716735ed696ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150633, "uuid": "5a516636-42cc-466e-b8c2-c3500ce768ee", "comment": "Malware payload (Rhadamanthys)", "value": "3335969c743a6dfd493c649b73e810b6ab753d12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150633, "uuid": "22a91535-616c-45a6-aca7-24ab185fdf6b", "comment": "Malware payload (Rhadamanthys)", "value": "8699f89cf7442c3b5d21a9092ba1875026cd0be17f80946e75a629c0955f6cc31c2ede79be097019505a5f94e9630d31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150633, "uuid": "ee559f71-9ad1-4c9d-b4ed-dd688d6866f0", "value": "T136A3E75F0F2788E54248DCA36CF023FD9C8D99AB78854BA1516E33A493F8D427BD4DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150633, "uuid": "dcb8e40d-8716-48a9-abad-3b6927ba26eb", "value": "3072:GDB7b0KqzOS1x4pTcQQePqzBYf9/5WMBQAvEu1UPH/n6l2/lJL7uyhFzvYsepAfz:0W36heWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150633, "uuid": "d5d61af0-c957-4cc7-89c8-d46aaf9fc649", "value": 104671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150633, "uuid": "caf1133f-55c8-419a-9f25-40f08a42e864", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150633, "uuid": "e71bd7b6-f96b-4dd3-a03b-7d40571c00b7", "value": "invoice-1637482117.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6201b8cd-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134721, "uuid": "54b8f1ad-e683-455a-bc4d-a2d85d64eb8d", "comment": "Malware payload (RemcosRAT)", "value": "83a7eae039f1b83e031f92d535fb3e2e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134721, "uuid": "a7db308d-1190-41f3-bc20-cf4719707902", "comment": "Malware payload (RemcosRAT)", "value": "5ca2ad629da920bdd3ee4316019a390d254df0bda2918e9fd57ff623d7fba5a3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134721, "uuid": "c58955b6-7ccc-4e27-989b-1c577e08acc4", "comment": "Malware payload (RemcosRAT)", "value": "e9ea3cdb2df708434ffb55a745a6f7adc01e96e6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134721, "uuid": "58461b08-3015-43ce-850a-13acfebe5ca6", "comment": "Malware payload (RemcosRAT)", "value": "be7cd2af2727d103d04648731418abe04e1541f98b04054105e54dcc278a6214ad8ce69a8450d518aae43fdbf1c7fca6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134721, "uuid": "043a1c2b-7463-4ec8-863f-d5357012e954", "value": "T164B12B1ACAE19AB41D2320613F383CD79E57F697F8660CA442E4552F9CB03D9939F42B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134721, "uuid": "ce3d2282-28f8-41b5-84bf-2faacc902f4e", "value": "96:6iEv3VCEHHJs0rHTIZlQvz8QJNtspaY+sfJ5UW8Vn5HjUj:o3YEJ/TaalNtZ1shj8HHjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134721, "uuid": "d46d8bde-3b32-4195-8aa1-4b721cbb1844", "value": 5507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134721, "uuid": "ba574656-658f-40e6-95d0-7ed1ef92066c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134721, "uuid": "914df91c-f5cf-465d-8b7e-bce8c6d79aed", "value": "RU5455675555775755464554565555557Faucals.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4c07d6-af0e-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761113609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113609, "uuid": "4721708b-fa2f-49bd-9e0a-f9cdf506efdf", "comment": "Malware payload (XWorm)", "value": "d4d9e26e0a685f6ec4a41ad986facfa3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113609, "uuid": "dab2d691-3628-4970-99e2-a5e33b936e7e", "comment": "Malware payload (XWorm)", "value": "5d61f940376f69ea37378bc57876dfcf0ce18547e02c8a7100908ba6e3feb28f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113609, "uuid": "4c8f3d5f-81d9-4e36-be1d-025b41256267", "comment": "Malware payload (XWorm)", "value": "ac06816450daa2baf823e73d83704678dbc21709", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113609, "uuid": "2e62a769-7a4d-4ab2-a84e-806c93fa8bd6", "comment": "Malware payload (XWorm)", "value": "042c0e3521f493a96d495dd5f95cdda0b44462ad7dd55f44cdf268cba4ba10903c7a5215e754f1d8bf0c1c44c21b86d8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113609, "uuid": "5c035086-21ee-4c84-babd-769569ea68f4", "value": "T1B1323815EDC319F8C3B8C37FF1105E89BA5A895582639CF81B696AD3E40DB1B86F805C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113609, "uuid": "691f9483-7fa5-4510-9de2-fda33a989969", "value": "48:6yUsMiPrC3kkug+aBtUg72uOofNhfsjXU9WXPxUU44UjRe1Aao9iEfZkBgBSNhQe:CHF3kgOgy1oXBXUx36iEfZIEJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113609, "uuid": "eb0a8541-38c4-4952-b3a6-99f159f0eb35", "value": 11128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113609, "uuid": "0e7482c2-d385-4514-a0c1-66ad80ae2bb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113609, "uuid": "ef3eccec-45d4-48b0-bc9b-8b5b6c979a06", "value": "Angebotsanfrage_289509582005_Metallbau_Figge.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5aa14b-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120992, "uuid": "84a5df30-69a4-4314-a845-2244e1bf19b2", "comment": "Malware payload (Mirai)", "value": "d6882e53a91fe831607eefaf07d59d81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120992, "uuid": "692bf802-c93c-4501-9412-10f9dd52e60e", "comment": "Malware payload (Mirai)", "value": "5e2e111f3cb4a53c9d934994c6ea9cba9f7bf5047a85d2c3785a3bf6c5e3ef25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120992, "uuid": "ef54b123-7be5-444a-ab3e-6efd455e7914", "comment": "Malware payload (Mirai)", "value": "5b6785ff6d5d36c348fc6cacd8e7fd0531b1d8a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120992, "uuid": "0da5011f-279b-4e4c-a857-793cc4347bc9", "comment": "Malware payload (Mirai)", "value": "d3647939024146e59d25ea13b557ac045a0eac3c361888a55140b166fd0c4ed4878e99a098c79caf4ca565da5de22aa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120992, "uuid": "482a5f5b-5611-452d-a127-cccf6759449f", "value": "T131732A91F8C28B7BC6E013BAA66E668E336163E1E2CF3127DD259B1137C510B4D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120992, "uuid": "3dccebdf-5c77-4875-a132-c8ab80bdc792", "value": "1536:y1qQ+kuNNkjxVhKTseWrCUOUSyTd7PSnFiNgJyU5i:y1qQ+kuNNkvZGFUU5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120992, "uuid": "09974a90-f428-4e50-8964-04acee999dec", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120992, "uuid": "9349c9a6-1070-49f4-b8b9-965e7534b591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120992, "uuid": "79749994-765f-4898-be89-833117b29422", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9900fe7f-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135672, "uuid": "28ec93f0-4596-4c6e-9d69-4226a2df1dd5", "comment": "Malware payload", "value": "de425a122985f5c2349ceaea77c15aef", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135672, "uuid": "351128bc-7f3e-4f0c-a436-b94b5d7fc9ad", "comment": "Malware payload", "value": "5edced68bdd3f90b469a02bb15cd02a2e1a446d2322b2f120261317d27a2915f", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135672, "uuid": "66fe0cf1-b8da-4806-91b0-0893a646fe77", "comment": "Malware payload", "value": "0d100d36bbcc3fda5101d0c77d4335faec976ac3", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135672, "uuid": "80dd0076-0756-4f0f-b80d-c09caab7b341", "comment": "Malware payload", "value": "85735ff1d4bf92d00550552071a0f6a0183a7e30b840bffe5d710b5060ecb0a2adf317c773008ea5c5f6fbaf8248ff76", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135672, "uuid": "e2ea5796-3399-419b-8c61-61c0d0927d17", "value": "T1E335232DF645AF02E3086A3154C6C6679359BC99BE868C476387378F3539B3652C338E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135672, "uuid": "2ac7be8d-17d7-401d-ade2-995d9a6cd0d0", "value": "24576:FKuwYNPB9fwyfFPzmiTT64uAZxRflBvqP1m66qMj+JNBCw8:+WZ9frfZy/AZxJlENm66qMj+JNQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135672, "uuid": "b56964fa-aa79-4959-9ec3-684809176e6b", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135672, "uuid": "4ad19340-fec3-4a7c-8fec-8c97e64f4e39", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135672, "uuid": "f223f7cd-2326-4e2a-b7f7-ea88deb52f09", "value": "Order \u2013 29BBCW1687L1ZQ.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fbccb7-af61-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761149513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149513, "uuid": "cc52232d-cb54-41e1-b6c6-7d30719a1389", "comment": "Malware payload (Mirai)", "value": "48fb078b8fa89b8c83e720477acf6232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149513, "uuid": "9ba1c4ec-2773-4d2c-a57d-10fdc0c49df0", "comment": "Malware payload (Mirai)", "value": "601eed5a7b63b0d044753a30a6fb8b15d644abdb7d49d84bee2a67a0154087f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149513, "uuid": "653ab1da-a4f6-4535-ad6c-a4fcb7d897ef", "comment": "Malware payload (Mirai)", "value": "f28d2f4c2d90dff9dce6978dc50dd0cc721671eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149513, "uuid": "54530b30-3fe5-404d-bc0f-5fbfc4ef55ac", "comment": "Malware payload (Mirai)", "value": "40bf73d3788dcaf4f01e067d0772e114e6af4d1fb27cb17f4dfc0adf454873b4750b103e43039e5508f9e09199994729", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149513, "uuid": "7d7c5e29-798a-4b76-8a60-3689db8c5e79", "value": "T138F31945F9508F27C6D522BBFB5E428D372617A8D2EE72039D256F24378B85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149513, "uuid": "a51c2ee5-3191-454f-9ba1-860aff7ccffd", "value": "3072:cJljhRKc9q7AUyj5/Is4bDgt5IXCz6IV8RH:cJPRJ2u5As4bY5IXLIV8RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149513, "uuid": "9c1a4177-875c-4d2d-b616-871bf0015b3a", "value": 157540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149513, "uuid": "ec1b0025-0861-41b0-abe4-9b13f3fe193b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149513, "uuid": "143bf5af-9406-4917-8fe4-d7ad2d50de6d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210b82fd-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149644, "uuid": "52771b2a-93bc-43bd-836b-3e0d2d442e33", "comment": "Malware payload", "value": "5ad06fc467f5fbec3c0eba7f72f1d9e2", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149644, "uuid": "38f4daf5-dac9-4f70-bbd9-5fb9dc622d52", "comment": "Malware payload", "value": "61dc6e4bcbad62b80a9adaafe268aa545a4c5b16ab972f8cc5c6628140087d84", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149644, "uuid": "ff610281-f667-4b24-aae1-a998acd6b055", "comment": "Malware payload", "value": "73485ff046dce5a3055ccde15547fe335c33c5b4", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149644, "uuid": "cdf05984-da5c-42cb-af1f-450e3f525f74", "comment": "Malware payload", "value": "6a3c3dca27428530f284b1665e959d0c14dd0d841ed109cba3fb1873d38fe4d7cb49dce3fd5eab3f8e694a87db2373a7", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149644, "uuid": "fd13ab0c-9ec4-4df0-8e14-18e99fb95bdb", "value": "T188919323CCD0896F4AF3405B4DBAA274FDE28937490D7D98F68E4046AF8625D8361C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149644, "uuid": "7fa116a4-3006-44af-ad75-731229956439", "value": "96:kXZIhrr6OxXYX6QXv4L0yXEXIX2z1C4aX2NR6lX3DX8c8JYT86:SofBt+6mYByu2hwiRc79L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149644, "uuid": "766e7679-6d24-4022-8190-5c7ac8f95fc0", "value": 4504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149644, "uuid": "b2743d35-a935-416c-9a45-8c970e3fcfd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149644, "uuid": "511d2d83-1e80-45f0-ac72-fee67da17e0c", "value": "61dc6e4bcbad62b80a9adaafe268aa545a4c5b16ab972f8cc5c6628140087d84.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca057fd-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120887, "uuid": "08f2278d-a8d5-48c3-8fe9-b321d34c9039", "comment": "Malware payload (Mirai)", "value": "7e049c1883f0a8cc79c05f2150c62522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120887, "uuid": "a5617517-8ad1-4bba-aee2-2a001bbc162e", "comment": "Malware payload (Mirai)", "value": "62aa6cb6ffa0cf504df63b17f68d262e6d416a95d2e1c8359e080e5797429a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120887, "uuid": "c0ded7d2-9bb7-4ede-9dfd-44c884beae5b", "comment": "Malware payload (Mirai)", "value": "c6fe052768126e0a4cbe166913a7d93e6be4778d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120887, "uuid": "fa7f42ec-74a9-4366-8852-59f17ffc50e1", "comment": "Malware payload (Mirai)", "value": "e02a41af0d3ad8bc664bdce13d5dedd0670a8d9839c4d8aaa3f020e8222c74ff9eaed93a2ee98085aaa943a8b6506189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120887, "uuid": "8902eed2-1a37-4fc9-8d3f-c1517d0c00b7", "value": "T193D2E1A3531BB421C6B06A3FFA94E6453A07C2B8F1F1B5B32B090521A9C5992CCFC5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120887, "uuid": "611fa416-f1ae-4664-92c1-2720b72b6e32", "value": "768:lQGFSYwblRZzvmWfO+VQzUecQGmXF0N4s3UozzLj:lWYQZvnVQMQH8tz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120887, "uuid": "aed381e9-e794-41ab-b956-a6112dc2edb8", "value": 29080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120887, "uuid": "7a9e1e88-1bc1-427a-b85b-aed569a7d44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120887, "uuid": "7b1bca98-0cec-406b-988a-f901eab26c17", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3b659c-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112946, "uuid": "d925f040-1f4b-4f62-9324-b6ccf2f2c9dc", "comment": "Malware payload", "value": "642b03b28a0ff4870183b0b09fa400d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112946, "uuid": "cc3b060c-4f36-4e00-8962-1b44aabcacac", "comment": "Malware payload", "value": "62e3fac20db21b1a45843e28baf8c47f1874737ae75271fc55e79dd01a51d0bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112946, "uuid": "03844ea3-a51d-4ddd-913a-a2881a6402bc", "comment": "Malware payload", "value": "505f338e198ac46f2b4d344ab5b5962190bbd8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112946, "uuid": "159416d2-ad8c-4717-966c-73b57479c4e6", "comment": "Malware payload", "value": "66abb89f15a673547b26374ea36aa6571488d08cd15bbfaea9dc13953c96177a6f668cf84600b83f0e561b257ad20445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112946, "uuid": "b75d0ee4-ca58-4305-88dd-a134d42e8cba", "value": "T1AE463947ECA555E8C0AED63086669253BA717C494F3063D33B60F7782F76BD0AAB9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112946, "uuid": "949391ae-96ca-4770-b634-3b55d1a85540", "value": "49152:nBiXb9hDWF4wAinLyjUHvodBFKZ6aPPxvk5EHYuzxPDGP/2xt7Td4KgKCtyofADJ:oDUjxKI5+EVoKmFoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112946, "uuid": "5bfae5cd-a688-4407-b683-0eb222e05e9e", "value": 5812376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112946, "uuid": "ac063c4f-60be-46b6-9ec0-d649ff89039c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112946, "uuid": "38fe8f9e-aa9c-49e5-8c27-80afd6ff258b", "value": "systemd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f52683a-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761114073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114073, "uuid": "39cc612c-5f8e-4648-a393-23084f5548ae", "comment": "Malware payload", "value": "1de3b274b373ae25dacd02293685d823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114073, "uuid": "c7a7f9b3-550b-48ff-a499-975a36bb75c9", "comment": "Malware payload", "value": "62e4f9b183f60e39dbfc78e53319791d032c345f7e52e25a373438e7dab8fcb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114073, "uuid": "a2c0da57-d550-4092-b315-5c61c2e07aa3", "comment": "Malware payload", "value": "196516b5edfa2ab6169022087ca520b5a7b25f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114073, "uuid": "72ab1258-b808-45bf-995b-00ae27da9a1e", "comment": "Malware payload", "value": "7d77a622c6eab9a53aa177f9bc237daf7410783000c1a4cd2390452cdd9e0e54a2ac6b5bd65d278b2f74551162e80d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114073, "uuid": "fdfc906d-84fe-4038-82e0-4cdd8f016dd9", "value": "T175F22B0DBBCE9B32C27C4A7EB9F2030413F4D1A2B643F72F2D8494A658937E45255693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114073, "uuid": "293acdc7-5a2f-4f2c-960f-77eabf2d72af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114073, "uuid": "22c39ee1-2a78-4bee-a1b2-6695ec37a5ae", "value": "768:X5LNpFRX/64GX2Sa4lUJ3bYKmXUB80TczrY6SHfcLu4Qvw:X5LJRXoX2L4lkSScrY/SpQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114073, "uuid": "e207b8c5-d0e7-4ff3-8f88-83979c8042f5", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114073, "uuid": "54b8ead5-9d60-40e8-adab-7f174a4f44f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114073, "uuid": "161d91e9-4b39-4de3-a764-3d47a8b08346", "value": "PO 3950-3951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d72425-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1761113272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113272, "uuid": "5f7f4ee8-fe90-4056-92b9-c80608ed1993", "comment": "Malware payload (ConnectWise)", "value": "51a0de6b20a4c7a63641b74d13893f6d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113272, "uuid": "b94e8877-76a4-4a93-b5dc-ac58aadac5b0", "comment": "Malware payload (ConnectWise)", "value": "6342a6b2c991d7953d24c2787fcfc63cc00b120d235abd700aecdf11b0fe0b73", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113272, "uuid": "c1b67da7-8b60-4f22-9a8a-22b21784185a", "comment": "Malware payload (ConnectWise)", "value": "1902d6369e82f647f1877c786f0febddf7f59947", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113272, "uuid": "8b2aeb1d-85fc-4039-b91d-b09c6e0af519", "comment": "Malware payload (ConnectWise)", "value": "6d78398c253164d97c51b53a0b294ea210d3e1b3a71f632b2e0d7a0cb638715ccba0d8f4039d38e0d70a0cfb320724ad", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113272, "uuid": "46fd200c-487b-44d4-a7fb-59fbe79bd301", "value": "T146E5EF01B3A44136D5BF0635DDBA66229B75BC190364C7AF57C879A92E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113272, "uuid": "fc31b8a9-3f9c-4aab-b9b5-1702d5c1063b", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113272, "uuid": "d83bd000-fdb5-422c-8e7d-faf379a313ef", "value": "49152:3jET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1gF:zb16Co69eWb0pnGpYmn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113272, "uuid": "02ed11f9-3052-4308-b844-ea3ceae99860", "value": 3130648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113272, "uuid": "3853f9c0-0137-4501-b7aa-d490fdc94c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113272, "uuid": "db4e902b-064f-4d1f-954b-f91848dba61f", "value": "6342a6b2c991d7953d24c2787fcfc63cc00b120d235abd700aecdf11b0fe0b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c818814-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150522, "uuid": "6ee0fdb8-3ba6-4913-9243-44cc2e233a0b", "comment": "Malware payload (Rhadamanthys)", "value": "b73f52500f830dc9cb29d0461d9632e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150522, "uuid": "dd15f8c8-dc16-4939-a5ce-91da9d9314af", "comment": "Malware payload (Rhadamanthys)", "value": "634470c40b742bbbb1da453792fef7c6ec9f66c97cfe02a7352226dd58baee05", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150522, "uuid": "c60c83d4-4185-46b9-bebf-86b6b35cc813", "comment": "Malware payload (Rhadamanthys)", "value": "35080e97f6409451dce15230269efbc7fa9b8d53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150522, "uuid": "46da7de3-e747-435d-9c87-9baf5efca983", "comment": "Malware payload (Rhadamanthys)", "value": "00e3a5280b1809dbc5d4e58753ffc4298270b86b1c971b4ddad01cb3afe6c92d85029f260e700c7429fabf175de7cf4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150522, "uuid": "7047240d-358e-4412-9521-5a4b6041992f", "value": "T1B8A309333E97FDE072627EDBDC0550AAFB4688206861D49F491E7761178A3182DC8ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150522, "uuid": "0f1fe174-6b92-4e53-95df-b4e5e9ff9c6a", "value": "1536:GDB7eKg20c1Wrfrg45akx2QJdABaz0qh6BkQWJ+aY:GDB7b01z1L8qh6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150522, "uuid": "03681647-123a-493f-830d-c33bc06f1171", "value": 103366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150522, "uuid": "64e24afc-f6cf-431f-92ac-0835b28ccbd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150522, "uuid": "7d9b4b93-2c72-495a-b5df-50fbbf8ae315", "value": "invoice-1637482117.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18adb3d-af9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761174797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174797, "uuid": "df762d66-a49f-42ba-83b6-4e5b5b09e372", "comment": "Malware payload (Mirai)", "value": "047385ab84fbce086e22339017c23c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174797, "uuid": "807fbe1e-5344-4e00-8f6d-b284d0762979", "comment": "Malware payload (Mirai)", "value": "636b50be950658dfc86dab85269b7832e745541815ed3077a31976e1fe266353", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174797, "uuid": "648d1a5a-febc-4dc2-9ca2-ea8c7dbe531d", "comment": "Malware payload (Mirai)", "value": "a8d3415eb92c0a38d84b37b870c5be70b597aeaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174797, "uuid": "08c88753-b721-4afe-9145-16b0a4aa8013", "comment": "Malware payload (Mirai)", "value": "96162e9d40ed2735621f9b376eb7ff24c60080a218dc7c469d6d33ccb47f9d779aac207d8e6f02b84399493794ace6c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174797, "uuid": "60b1984d-a7cc-4967-960d-bb4f6c26389a", "value": "T1145301EB90C8135BC32D203D49ECF729446AC15575E38B6A47ECB879F4AD3DA1A68290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174797, "uuid": "3c923cff-518c-486f-8f0a-4de42108ec32", "value": "1536:D/vJP7cfMpSRfALaHCMDw1Jpdm397zIpGu/Y0nouy8KyQ:7vJP7FpbLXYwJpapQYEoutg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761174797, "uuid": "3d2913eb-768e-42a9-bc0f-adcda548f227", "value": 63036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761174797, "uuid": "1191a1a5-bf12-42ef-9c57-53aae0056903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174797, "uuid": "2ef429eb-043c-4feb-835d-7eed53b0be84", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c28f79b-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130845, "uuid": "6983dc31-80b1-4354-a8c9-4d0ce22a8d71", "comment": "Malware payload (Mirai)", "value": "254d8df47465f2384ad91a6c731dbd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130845, "uuid": "465299d4-ef74-4ae7-b7ce-13f23667ff01", "comment": "Malware payload (Mirai)", "value": "639cdcd7c2cffeaa9cf20141b1d8e6664cccc8713f2fe7bc6e6beb313fec5a33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130845, "uuid": "a1f4e94d-89eb-4e6e-a98b-3d980818fc5a", "comment": "Malware payload (Mirai)", "value": "0b7842a1edc07c245f61ce997230c7e84f1b2154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130845, "uuid": "bc9174f3-bc68-41f3-8050-91caf590ebbf", "comment": "Malware payload (Mirai)", "value": "663f93d185282739b33eae1f4385ea49b7630364ef69bc2fd968675f7efd5bfb5ee73a77813f7674c35cee8c14281ac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130845, "uuid": "7f02d485-b1fd-4684-bab9-d173abd0a349", "value": "T1D9B35AB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DF606BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130845, "uuid": "e7de0304-26af-4ae8-86a7-691c7745228f", "value": "1536:WTW/VCxsHZasA2Li62C8faKzR5/vPVGA9oWWszbW+AFKVFd:WytCxcAx62Nlz7VGtWWcbb7Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130845, "uuid": "0e23a387-420b-44d6-932c-3338e2677b6a", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130845, "uuid": "7dbc483e-c8b8-4b31-8bb1-ec5466a7dadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130845, "uuid": "b9d48a9e-8792-45a6-af31-abb8ba5336ed", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1def6127-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149639, "uuid": "0d4d9ce6-5bef-40ee-9a89-283af5dd4bc8", "comment": "Malware payload", "value": "2479329c86b23c7722b4d3dfe165d7a4", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149639, "uuid": "005ef481-429d-4c40-9cf5-974e145e1aec", "comment": "Malware payload", "value": "6443b645488ad753092e34da754cb22956d5fde713ad80061c087966fcad5170", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149639, "uuid": "db9fca1c-ce49-4b03-8679-d999bc37863c", "comment": "Malware payload", "value": "99bf8ebc878f6b6877290dfee2407a5080292149", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149639, "uuid": "b1614804-dd69-47ca-ae95-bb6da85b94a8", "comment": "Malware payload", "value": "0e9d425e85bd2449e25e33aee89ba1264fefdee2f96f1ba14830c284b1e2f3a53d42b6eb96d9fcea6061767fc7282a2e", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149639, "uuid": "768ca103-c621-4719-8d58-d8617ab9baf7", "value": "T1F1C02B228AC9D31DA928C18126356987C011804834C1090C49047C4D020C2229CD7000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149639, "uuid": "23e1c4ba-893b-4d49-9757-6823c29489a8", "value": "3:TR6fQ0QRwJAFHAcNfKC5S7ru1MFIKcp2RPmyViEaKC5SW:16fQpRwRcfZ5S3u1MFI3p4hnaZ5SW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149639, "uuid": "86132a3c-152f-4a1f-b69b-3b8136727f5e", "value": 133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149639, "uuid": "810eba39-9446-4303-b43e-8240e09e3dc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149639, "uuid": "d474f0c7-231f-48a6-a90f-ef8e522fcd29", "value": "6443b645488ad753092e34da754cb22956d5fde713ad80061c087966fcad5170.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3c629f-af37-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761131464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131464, "uuid": "16070f72-e75f-4a34-b729-6e96df0db3e7", "comment": "Malware payload", "value": "2e93f4fd7b2fdc177dd2bba248ec1ad3", "object_relation": "md5", "Tag": [ { "name": "185-100-87-223", "colour": "#056853", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131464, "uuid": "f31084b5-e3c2-4455-8f55-1ebdbac47814", "comment": "Malware payload", "value": "653201819cb651d397c8c01f36036cd317e53dd1eb61a337051f246a3008a11f", "object_relation": "sha256", "Tag": [ { "name": "185-100-87-223", "colour": "#056853", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131464, "uuid": "9e55e694-dcc4-4a97-86e8-5bb56258738e", "comment": "Malware payload", "value": "82a35dd0ec20791bc3161a87fdb6caa68fd3d4a6", "object_relation": "sha1", "Tag": [ { "name": "185-100-87-223", "colour": "#056853", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131464, "uuid": "a277d82b-0a64-40df-aa48-cd619eb1d45a", "comment": "Malware payload", "value": "0b4abeffab53a23a5292542b340880060e847329569cb48b4372636b80ed6c4f17827342160cfd2d8189f626649f2185", "object_relation": "sha3-384", "Tag": [ { "name": "185-100-87-223", "colour": "#056853", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131464, "uuid": "da4fd6c4-bb13-47a6-b613-54b60e58c00f", "value": "T100E52245BBA6988ECC7782391E0B93384642ED93C957C387F2E4332C647B2E44F946E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131464, "uuid": "d2435751-e222-42a6-a2fe-369ba89236ce", "value": "49152:J+ulH11k/+hxYZ1I7BKMXJDnuv6O4Tt0YXx1/TERw0XPRrRx/FDLdb:JPVKWYZ188IJDuh46Yh1/gq0XPRrxdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131464, "uuid": "7224f18b-625d-4d21-b186-afbdc8c01f52", "value": 3111951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131464, "uuid": "51144093-985a-4679-ba78-ddd48d27baf4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131464, "uuid": "eb681dea-2d2a-40f3-8b66-83143a98d9c3", "value": "Air Banka 1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854ac034-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135639, "uuid": "49023bbf-9c32-44b1-acd8-c09a7c15496c", "comment": "Malware payload", "value": "e314856c00725766f143d06533251959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135639, "uuid": "349937bf-355d-4244-9869-8147d7a12ca9", "comment": "Malware payload", "value": "666495c7a5a70cfaf4a269c7ca5aa7c042ddb195d24eb53cd135e3efff40491a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135639, "uuid": "a0f941be-a163-409f-a86d-a5112a0d49d6", "comment": "Malware payload", "value": "db47cf4671b2f61147b8f2d9621058284f98796f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135639, "uuid": "c3113c3d-71c4-4d07-918d-7589fa0db2be", "comment": "Malware payload", "value": "7eeb9dd73247cb07ff136e9a9d61434ca91917f24d54e8e38d674a7306830897ade0ddfdfef501294a0ef7756f9e8974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135639, "uuid": "de5226ff-8c76-4ac9-a703-a03251e5a203", "value": "T1493522005BE96866D5B967B099F50313AA31BAF40F7617BF12C8D2B80F537C09531BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135639, "uuid": "938c0542-585a-469e-bacd-50b0fea0709e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135639, "uuid": "51d78004-49b6-44db-852d-16bd7a3ff647", "value": "24576:c1s610x7p2Y7b+1NHJnHXHpCp8aQ8tYBRvCw1VwP3wGahJR8GZwuR:Ys80KZHXJC+itYBT1w3wGazRWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135639, "uuid": "ec88246d-da75-4d45-a7fb-d2201617bd0c", "value": 1136168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135639, "uuid": "918baeca-fc67-4553-b56f-21bf1f4038da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135639, "uuid": "326f7d02-ca81-4198-b8e6-07d729594a70", "value": "e314856c00725766f143d06533251959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a74dc8-af3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761133806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133806, "uuid": "e8f5a897-70b2-4e85-ba7a-dcaf05ec527b", "comment": "Malware payload (AgentTesla)", "value": "626f8994ef759da5c1eaf9fee2354e09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133806, "uuid": "3766f085-3941-4558-a3a0-4f4412736011", "comment": "Malware payload (AgentTesla)", "value": "66751fb1f1414c0fc2fc0bf7bbe6899a0152b61c00b44090efd85a789cd0a3b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133806, "uuid": "4a9db537-986f-4a97-aa29-2c86027c3e07", "comment": "Malware payload (AgentTesla)", "value": "d7b96fbd36c61ae3783eb4af60b20078adc320b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133806, "uuid": "c47b033b-a7d8-4395-8115-2b2e81cfec79", "comment": "Malware payload (AgentTesla)", "value": "9889dfdf105e304219fb903180aed2b41049287d6f6e196d34ad5a554e0d6ff752a0713016882e603c316f520812642e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133806, "uuid": "e590684f-c679-4b47-961d-baef40c86b5f", "value": "T14226332532314710AFED1C83433A4F1905A4DDABBF40E7AB983D58ADFE1766B8751A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133806, "uuid": "f435d1ff-f34a-428b-8550-0419714af595", "value": "98304:zA/dT5M8Ra++Idtswf89PmyhDxHUtxw6A6u7M8PkmJmayDh:zA/ND+Iblf89PLDy7u7M2kmJxyDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761133806, "uuid": "6942bcc4-e8a6-4b36-a0ba-c2d9aeddd9f7", "value": 4649300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761133806, "uuid": "c9ffee4b-7b9a-4240-b406-88392bf61d4c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133806, "uuid": "2078a456-af24-4d55-91cb-958c922e1da2", "value": "aaa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1573cf2-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130961, "uuid": "51dee03c-c8fe-4022-85a1-e00419dc1b7c", "comment": "Malware payload (Mirai)", "value": "46000223b99caf422c36766ba6980d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130961, "uuid": "d3c5cb30-42b3-491f-b5db-95d81defd248", "comment": "Malware payload (Mirai)", "value": "677880a18567e9faa1fd0c709c03a92cf6cc2fec72a3a581422160ac8ce709af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130961, "uuid": "98948fab-5e02-4309-85a3-7566834888a7", "comment": "Malware payload (Mirai)", "value": "033d39f8683282d043d5cfb6c7f783288e0d778b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130961, "uuid": "ce306ccd-db29-455e-aa20-d73609c8527c", "comment": "Malware payload (Mirai)", "value": "059497acdc5c2994d1be5d3f436261e4c325185fa2a89c80d3c640f2a7ba67d467ac972c3efcace9e368f321075e4351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130961, "uuid": "acefda28-0744-4aad-934a-7d1337809877", "value": "T1DD434A95F8828A12C1D1127BF62E9A8D3B2563E8D2DF73039D301F6136DB82B0D6BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130961, "uuid": "d44aedec-736e-41e8-b499-3efbab897d0c", "value": "1536:75wmKQGZbpPaRWKC51It5XrlaGAb+10mO:75wrSgKGabXrl7Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130961, "uuid": "d58dea3f-843c-4ec2-a083-1f423c1c3738", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130961, "uuid": "f21b2ebb-e305-4dec-b37a-5d9d310640ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130961, "uuid": "e137b037-4104-408b-8dc7-3299a2a9ba86", "value": "botx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a56e403-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137258, "uuid": "d8ef7573-ffd6-4c81-9f87-95c700b1b8ca", "comment": "Malware payload", "value": "172cec9e4dcaba933811daf1d2c56045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137258, "uuid": "12beafec-223e-40a2-a376-ac74ff17afa8", "comment": "Malware payload", "value": "6941563a74b6f591a35bcd79ba90608031953f6662e392142dfa64ba0b9da1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137258, "uuid": "fb83efa2-8d7a-45a8-94b3-d2252f61b7b1", "comment": "Malware payload", "value": "5d002e1d87280ad07f0f3508001e0432489f11f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137258, "uuid": "d99f97fe-412b-4388-b913-d2781ffe945a", "comment": "Malware payload", "value": "af6bf76e6863acfa13ae068a476aa84ad7757b4dba5c3cffc8be82f1ee30761ed7db0dda687e54fa0b61a57afe55b23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137258, "uuid": "6a9208ed-8aa2-4f8c-a4e1-aa21b71423b3", "value": "T1430633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137258, "uuid": "21548ccf-e1b8-4e37-ab26-048930aa4b52", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137258, "uuid": "321afce3-3319-425e-b98d-384ae772c475", "value": "98304:ahT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:G2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137258, "uuid": "3a113ffd-8dcd-463c-b227-ffca4ec26354", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137258, "uuid": "ca5d2be4-5ef0-4e36-928e-efe74d3f046a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137258, "uuid": "238ef9ee-5aba-447a-8571-cbe9cd8e063b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a58591-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150652, "uuid": "cce91dce-a2e2-45da-847e-184a0fc890bf", "comment": "Malware payload (Rhadamanthys)", "value": "c5a792a92d076b718c5a745a796d0291", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150652, "uuid": "3053bdd7-cd38-4482-b6ab-f65909d83a61", "comment": "Malware payload (Rhadamanthys)", "value": "698a408ce57efae389db012e528641e44e1082693aa1113af5de22e73713a735", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150652, "uuid": "6083c0c6-7f3e-466a-9abf-3cf7b332bfee", "comment": "Malware payload (Rhadamanthys)", "value": "eb105dcaa2ad4d79789b8b836a5b3159487e7d84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150652, "uuid": "caf26fb4-27f9-46e2-9614-b50959676c8c", "comment": "Malware payload (Rhadamanthys)", "value": "56147a3e127ec01fd1c57313718b615ff36756be5ab536998f5afaf2f04b0ce9425985eb8cdee60b11ce8077ce765cb6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150652, "uuid": "bfed51f8-ee36-4494-bbd7-d9a03cb158c8", "value": "T15BA3E96A3892BDBFE97532924AB0772B45C2A00562461404F13BF3D7C9D9F81D706AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150652, "uuid": "97f7b02b-afcb-4ab5-8976-cdab724fc7ce", "value": "1536:GDB7eKg20val2kikhaai2bRlS+t7ih8Z+8QqoWN+U/7GoQTEtAoWbv/ZmUTrFsG2:GDB7b0onXYepO6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150652, "uuid": "35061510-b927-480d-bbb9-b6c5097c6cf6", "value": 102073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150652, "uuid": "e4db42f9-0f85-476e-b54d-ba0f8613fbc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150652, "uuid": "23ab7d3e-6e33-4573-bf70-2b7436211969", "value": "invoice-1637482117.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9c382d-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761138251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138251, "uuid": "cfc52ac5-a7f3-48f5-86ab-d446eb426501", "comment": "Malware payload (MassLogger)", "value": "4898245f8fa335da7a2c2d7c25affcb0", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138251, "uuid": "41a654ec-a2bc-44f2-a4e4-91635c80a507", "comment": "Malware payload (MassLogger)", "value": "69b63b9065d7e2add8b694901bd6c306db94c5617ac9c94fd4a9d05471b23404", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138251, "uuid": "a85b73a7-13d9-4244-827c-d0bbc243cb3c", "comment": "Malware payload (MassLogger)", "value": "1737da9bdc8003a0c34254578e75de6081e72a24", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138251, "uuid": "d701f6c7-cf29-4eb3-b7bf-d8039f87cfb1", "comment": "Malware payload (MassLogger)", "value": "7028605b7a498f07db974dd095ddc733efc94ff0c8ad0c3b81e98903981c9e796b867247273d36d6f70bcd2135e59093", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138251, "uuid": "db98fd3d-d1a3-481c-8f5a-12b3f1c6545c", "value": "T1610529F237DF7A4B5A15335AA44D29580F5FD4241E83B6D4A0DB0BD8580F48B2AD0EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138251, "uuid": "6ed23b9a-c8c0-4597-b7fa-7f0503265cc5", "value": "12288:qWSOiYhcxaUrVvl/HEjio5rtzBrcXyuaStZLgUrfj4Dag58F:qWFi/bNEOk3VujvgU7cWgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138251, "uuid": "94d8f74a-2844-4ce5-8b25-0d3a13a83977", "value": 841740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138251, "uuid": "bfe060c3-cee2-46a7-918f-8ba4de4479fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138251, "uuid": "70fbcea1-0437-49a5-aea4-198cca6c18df", "value": "TEKLIF_0001021.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588e6a4c-af9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761175507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175507, "uuid": "2dc03bc2-dfea-470d-bb4e-021749141257", "comment": "Malware payload (ValleyRAT)", "value": "588fd7739a8d9ca39ab85c621d47fb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175507, "uuid": "b79bc911-67e1-4921-b99a-079c8c54d767", "comment": "Malware payload (ValleyRAT)", "value": "69c8b89a02b2f0cafab2c4da28802c2f6befe6860c9c82c63a446868c1197a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175507, "uuid": "aee08e6a-c394-4c12-9aeb-16a0e9a29146", "comment": "Malware payload (ValleyRAT)", "value": "8595915dcca3f1ff81989495fac63113778a7c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175507, "uuid": "c17bba36-79c5-44bd-af07-b7dcdcccc835", "comment": "Malware payload (ValleyRAT)", "value": "4f6381bceb2a5fc554634bf188db2ee03e370a1c191432ecab5de50948ec8b1bd049fbe8ea2eec64bd2e3fd87182d17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175507, "uuid": "16554ee9-9d36-48d8-9dc7-ff50ec2d3a41", "value": "T15EC3AF80695BCE42C7D650FA8E36FC960E5742F1D5F00B3EAADA38D87150EB8B384957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175507, "uuid": "1dbdcf39-6e57-4c43-bd36-284bc90e43e5", "value": "ddb545c3fe4c79284f65b309d1c7718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175507, "uuid": "c0ae7774-fb23-4109-863c-13a2c4d2f27c", "value": "3072:Z/H+SK+QfnEkxm6UwJppWiziq44LB80uw9yNzL2i:BKHntxnpWiK4LB8dw9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761175507, "uuid": "334c5cf5-a4cb-4936-ac64-e8afd9c46f64", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761175507, "uuid": "e9281d52-340f-4915-8329-e795f85599ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175507, "uuid": "fb5db302-d0a4-4410-814c-8c019219b6a5", "value": "588FD7739A8D9CA39AB85C621D47FB98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0f5fa8-af37-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761131409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131409, "uuid": "b02c76cc-8ea4-456b-a75e-528a69c20d30", "comment": "Malware payload (RemcosRAT)", "value": "9d942215b8cf8db36fc126ece1d082ab", "object_relation": "md5", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131409, "uuid": "2c67eeb8-e3ad-4a5d-bcf4-e55e8a9474ec", "comment": "Malware payload (RemcosRAT)", "value": "6a763d0552a9efd331ea5ea53e505772b5b6d0cc9bc9512da5d34859d1dbb544", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131409, "uuid": "37933ebf-2841-49d5-8838-114080b17ab1", "comment": "Malware payload (RemcosRAT)", "value": "7d70b7fb669136976859f7258f28243c43226950", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131409, "uuid": "7eb6f9ff-64ed-4e26-9f37-b8fe2150e6f9", "comment": "Malware payload (RemcosRAT)", "value": "febef6d59eaab7916056f9778f61f32ac8af55e2eaa4735597213e3b3d4d6624f19d0a0eda85c275dc31a9510ad7d1d2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-175", "colour": "#4478D5", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131409, "uuid": "ec6bc1be-19cc-4fa3-a305-11423055bebd", "value": "T1D23523196F42ACADC12C833420A8BF359BA8AB94D239D1DC17D1B08555BFBB6C647CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131409, "uuid": "eb174d70-9412-4d0c-b804-675d91cff4cb", "value": "24576:EKw06qzmngues9mdPC/jA6RZBWahIzooB2N2dtgsJTgy/CX:ELixfkHzgjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131409, "uuid": "3247676d-866a-43ed-a9fb-8341fd3753b3", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131409, "uuid": "d7273518-7282-4ae8-8913-24a212c95423", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131409, "uuid": "b3fc2be9-8dd0-4337-b0ad-b089cdfa372d", "value": "Bper.Banca.Copia.di.Pagamento.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f31a53e-af15-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761116543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761116543, "uuid": "d1954ebc-7293-4fa3-bf05-7c099397a96b", "comment": "Malware payload (SnakeKeylogger)", "value": "fb32f7acd3f3386c76f5a4df39667040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761116543, "uuid": "bfedeb6f-9158-4ae4-a22a-f770b702b26b", "comment": "Malware payload (SnakeKeylogger)", "value": "6aeae35043c9ba97b7ef2fefb3a49943431eac600666e20614f09e5783328a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761116543, "uuid": "57361cca-b951-4b5e-a158-fd69c63243dd", "comment": "Malware payload (SnakeKeylogger)", "value": "0be8d989d0dbc44c838f16dd2a948582ffdb98b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761116543, "uuid": "3c538bea-a7f6-4311-acec-5043d1a16154", "comment": "Malware payload (SnakeKeylogger)", "value": "2462a0e938e5d32a15e01be10c9c19470eb528419ce7c4df234d4a19bed5ac80fd89d0fb6211b1a189f62b37096a2f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761116543, "uuid": "323b075a-b057-4ede-a4e6-d1a8a647f13e", "value": "T18CD4CE8C36D5F8DEC847C5704DA0FD74A2206D6A93068D138EE72C9FB91D947AE341AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761116543, "uuid": "ed1cf940-ee97-4bfb-83af-6153f9f51dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761116543, "uuid": "ff518190-44f3-424b-90ca-973887e70dde", "value": "12288:Ke3YXOpUjuTtYUltsiykrGMguXrvFfDqqCUf6JggA7JH62j7TAjFtbwWAZMeS:Ke3YXyJZlin2GMguXrvxNCo6JeH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761116543, "uuid": "97b107fe-a6b5-4bc1-8586-bc0f2414c63f", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761116543, "uuid": "9a794061-1ca4-4e8d-b99e-0ab966fabd0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761116543, "uuid": "0fde27c2-2314-4a7f-8d92-2fdfa89e0ed0", "value": "PO_SOL44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe28ba7a-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761114367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114367, "uuid": "85a2f05e-e8f3-481a-833b-6492382f06d6", "comment": "Malware payload", "value": "155909267e7eb23b0045346a34170a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114367, "uuid": "f4cfd64d-d280-4c93-a7a5-cc13bfadea41", "comment": "Malware payload", "value": "6be4baff25038f2556b225aa99f0cab4638b99f87e9999ef223e11c96615542a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114367, "uuid": "6cdb4ff5-fc9d-4d24-88f9-b5bc06935c09", "comment": "Malware payload", "value": "ba5ee8779201633b45ef95e8d68279e3b50ce62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114367, "uuid": "027d1c98-149a-45a7-8be6-fc11282b72b1", "comment": "Malware payload", "value": "5fe0644881ab3d0f8cc70a1147aae96174886c7f7a80d8e87c957cd05cf903e0bdb2f3dada9229439d8556aeacb0f084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114367, "uuid": "69161f0a-a648-4877-ace1-ed55253934cf", "value": "T1F3C57CC16ED74092E5BDC3B091F2504EF12EBED84E2BC66B3318D468ECA6809D756376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114367, "uuid": "1ce8011c-6c96-4437-a154-78ff4da25f9e", "value": "744b8668340c0780ea1865df1a6c1af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114367, "uuid": "81e2f422-1fc5-4553-8315-9fc041b0e773", "value": "49152:KYLpqCHFouBSS4kP+huNn7ubhsgKWygm2nPsj:M0Fou7LPZNn7ubnegBsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114367, "uuid": "9ff0c2e4-a7c2-4ab7-8add-84fe4123f560", "value": 2594816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114367, "uuid": "dad4c0b1-2a2e-4642-8a20-8192e41b314b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114367, "uuid": "8858f424-2f6b-43f9-af60-e83a7a19e81a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.62364341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9b9d8f-af0c-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761112675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112675, "uuid": "775bc0db-9819-42a1-bd8c-2738f1c1d7e1", "comment": "Malware payload (a310Logger)", "value": "ae55a15152c63ce22192229683a346de", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112675, "uuid": "4b810013-69bf-41fe-98ad-50b05200e18d", "comment": "Malware payload (a310Logger)", "value": "6bf85d8aa28197fbd7ccfb4bc917c664071f047fd21fbc6a47a9fc7c2da016e2", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112675, "uuid": "9d40f1b5-60fe-43e0-bb47-b2f5f5f01d0c", "comment": "Malware payload (a310Logger)", "value": "45b2117279989c9920bdb041039d855a48b66490", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112675, "uuid": "aee99596-17a4-4569-9bfa-9286cfdc8fb2", "comment": "Malware payload (a310Logger)", "value": "70e3fcae30a1d452ded17140a318c0f16add01e490dfec77ab01bba17566edb6388b296fee5f15d9f467fc47a45a732e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112675, "uuid": "82485537-ee02-40dd-8e10-e15b09a889ac", "value": "T13675D011FE428D7AF01E3539D81BDBD6181DBEE12A14B90E3AFD3A4C6F396D36516082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112675, "uuid": "a4f04424-5f10-4381-99a8-8857ee0d8bf0", "value": "37cefd31e003cee7c8f3f0b24332ee91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112675, "uuid": "f4f22349-3da3-46fe-9d63-f9e15463dae7", "value": "24576:8c3ku3efFKfwG32uJQiWjSJx7JUf6GQYtyMtQI7z/pyq349eqdrxp:/BvyiuSXt+HyiQI7zRyqw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112675, "uuid": "62226532-f206-4b4a-ac3d-e2ada3ca9273", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112675, "uuid": "9bfde02b-01b5-4a7c-a0f7-c4e74790b426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112675, "uuid": "3c809874-49fd-43e7-b9ac-eb05f39476c4", "value": "PAYMENT.pdf (~51 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74a80d8-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135803, "uuid": "de2e2aa9-bdf7-4185-a106-3630a2ac583b", "comment": "Malware payload", "value": "d9d11b91cfe565de49f2678fd1703818", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135803, "uuid": "cad1c87b-42b7-4471-bff6-e3bd67d61556", "comment": "Malware payload", "value": "6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135803, "uuid": "93358c5f-f3d8-4be3-af03-969a6c3ff4a8", "comment": "Malware payload", "value": "bcedc2919ca4f8406ca11a4dbf47f254ddeaeec3", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135803, "uuid": "5930153b-faee-4fdc-a73f-dc4c08ae4e72", "comment": "Malware payload", "value": "686b96980ab38cca220a8cb4e0ed256e9945279dd40f6484c5bfac1f47be752175aef2bb2f48fae3d9a89e392413b3b6", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135803, "uuid": "22718899-57b2-45cd-9d60-28c158f69bbd", "value": "T10B18332AD42064B8E71E913B773F4850BB1B1BAE6B115BABA435749E1FB03310E4B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135803, "uuid": "7c3eccdf-4504-4ca2-8231-f02a18515f4f", "value": "1572864:PHR9COaCBn0J4V2Kck40dPIs0b3XL5614XTZJuILjFc7UKRSWSwIPLNw:PxYCBnC4Kl/H64lJuUKRS48N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135803, "uuid": "017bed9c-1dfc-43fd-bba0-02ee60fe7c9e", "value": 91615232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135803, "uuid": "b5e71183-c026-4edb-8874-fc35a018c0cc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135803, "uuid": "4cc85f0c-5152-461c-a455-f0e4cc59d37e", "value": "LostInWinter 2.1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8dde2a-af56-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761144613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144613, "uuid": "cd13b94d-17d4-484c-aa63-d888c4e711b5", "comment": "Malware payload", "value": "e5024c89712984af809bd0a1e936cbab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144613, "uuid": "24618081-0fd1-487a-b801-d324324ce33f", "comment": "Malware payload", "value": "6c22b695934356f54213159d31160fb8d60cc66f326980f29358f04c68b0a1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144613, "uuid": "c3bcf577-cef3-4233-a01d-572f3a1b3cfc", "comment": "Malware payload", "value": "533c1433d95193e57a881994bf5550f52702fdd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144613, "uuid": "820ece84-95b7-4af5-8025-aa441e6d9b8b", "comment": "Malware payload", "value": "1db097e7d069065fc22a002f75d3062034ba13b87fb0b6ef2b0daa9c8a0b9a685252d4aff0401d780134ccca44502aa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144613, "uuid": "310c739d-ea1e-4ca5-bf15-a0141e6b9e47", "value": "T1E7747D2AFA11F46CD24BC07057EF82F396A6B4BD0165392B7BD8DA313E25C915B08B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144613, "uuid": "19c5eceb-55cc-4c98-a79e-b26cc6fd3d0a", "value": "6144:VmI4s+T+7NShKML5vs7jRg1bEsrN3sCOb1HOZK5K/OIxDyHWjHGkEpFo:V3+TkNShbgjRgEHQ1EpFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144613, "uuid": "b4296583-ff21-4b86-a245-29bd1cd9c314", "value": 355168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144613, "uuid": "65439feb-f4b4-4312-a97a-e5ad50513d91", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144613, "uuid": "de57b0c6-f94a-407c-b262-ae779b0aba7e", "value": "index_linux.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f58a4-af05-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761109679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109679, "uuid": "a091e219-38c2-4162-8cc7-f912f46a5693", "comment": "Malware payload", "value": "9179d74e18be6f9a497040993b3a9f76", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109679, "uuid": "d0d9d611-5c12-43ed-8911-2fcbe1cfd46a", "comment": "Malware payload", "value": "6d9792b7b8f4b15f1cf4f9cd10c19f6027c5b7194d59e80f06c070588fae7ded", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109679, "uuid": "a871b37b-bbe1-4100-bbe1-74eca34e4f68", "comment": "Malware payload", "value": "e24b50ba4cc8089ca88aa6d3b1a481bcc0b1eaa1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109679, "uuid": "8b4ee8bf-f87f-4163-b780-a53d03f897d1", "comment": "Malware payload", "value": "db9d73fbfcef0afedb33f7f4037a86d2df09d0f2eacd0abc311f3abe76bbc12adb0abe019db3c70c2dd9c36be28a26be", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109679, "uuid": "ca017550-dbea-4367-929a-5d24ca257480", "value": "T10A464940F98B84B6E607153134E6A36F233CAE04C734CB93D6507E66EB776E2DD22616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109679, "uuid": "7526b963-1159-4415-867c-da15f6d6567a", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109679, "uuid": "c4f01270-11e2-4c0b-a6d5-10a075da388c", "value": "49152:Sg9u38+KvFeyXzoQipY1RqqrYKYgKcWVZencIj2D0O0LF1MEx3WNemex3I2wTc8:Sg9w81vbzoQX1RqgKn10eEhmgY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761109679, "uuid": "328b7112-62ae-45d5-b24d-00ce2c8a95a7", "value": 5675008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761109679, "uuid": "4f716fe8-3f74-41f3-b2d0-7531fba60cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109679, "uuid": "e66fbe67-28cb-44b5-831d-7b3ecc018c91", "value": "pycharm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c6ba0-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761134851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134851, "uuid": "b2c68e04-c819-4a4f-9f51-e6972f4c8fe5", "comment": "Malware payload (Rhadamanthys)", "value": "00d55362d115215e85bcb4025ef38b96", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134851, "uuid": "67b9ca73-341e-4c64-9b1b-108962e83aa3", "comment": "Malware payload (Rhadamanthys)", "value": "6dd552765a28ec262d26a77e8838acf422b504d59c8c74ccc98c3680b8914134", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134851, "uuid": "78d0ce8b-6aa4-4be4-a137-a373698836e3", "comment": "Malware payload (Rhadamanthys)", "value": "8612a1867ea1f4be5230189f76058b4358062437", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134851, "uuid": "0a170401-c323-49c4-9dd0-5042bf17d4f4", "comment": "Malware payload (Rhadamanthys)", "value": "c03c363c29c394b5b015417ab7710e49eb3706214c11ed33732cf9287b1c18331c94e27083024d525a817ea9289d4b3c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134851, "uuid": "be86251f-53fb-4571-93e2-0e23574095fe", "value": "T143563345FC9F7A54CA6663790D7FF92AF514CCC0370BDD7A66A2F28A623E570809C092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134851, "uuid": "4a5dc170-865f-460a-93a2-009a361443c5", "value": "98304:SQZUs0ng9DHjGBPjOD31/SdzfF3gvc3H4iVJ5ZzjYksP3ssUdwCg5U+bBUjSnM+v:SQ900DDwPolSpBD9VjZz8NOd72mjSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134851, "uuid": "eae14cf9-73ca-44b1-a1cd-3bc5ccd0271c", "value": 6098944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134851, "uuid": "e582cccd-5b38-41a3-9933-43ea5d83723b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134851, "uuid": "8917ffac-e54d-476f-9e31-7e8e1d07eeab", "value": "Set_Up.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c28646-af9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761175989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175989, "uuid": "2803f3c8-ec53-4ebf-97a1-2e2e6a6e84e9", "comment": "Malware payload (Mirai)", "value": "94573356fea96fd91df14327856eaabf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175989, "uuid": "2728a33f-f3c8-4b2f-a17c-3794c1447d66", "comment": "Malware payload (Mirai)", "value": "6de59d1c39a1a46b7ebc611395e483a845d2300130f313f5a0cf37e049760b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175989, "uuid": "43cd4ddc-088b-42c9-94ce-09c5fdac0a72", "comment": "Malware payload (Mirai)", "value": "0396b3f55583b8747e8e35bb3d823b9e416834de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761175989, "uuid": "f931e985-19b2-47ee-91bb-4d2246f189a5", "comment": "Malware payload (Mirai)", "value": "2c814f7158032d9ba1d627bd9c475fd2007e83fa12198a49a4ee77ae15ea5c095b4aecc4e3c94edfe246fb9821d16b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175989, "uuid": "cafe1049-4673-4a6f-b3f7-5a0731f527f9", "value": "T191830602BD828E13C5E112BAB9AE51CD372567FA92DF3213DC212F90778649F0963F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175989, "uuid": "79f48d3a-85f0-4e00-b54b-17c5cbdb31f0", "value": "1536:7eyzqfgYrxw8Hf/vqpTlu7JrS627NSDozjm5HWo+1gA82i2SkZTfH/H6dhQzqPLB:7euogox7kc2itwffH6dhQzq2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761175989, "uuid": "d6bff059-c94f-4885-8d53-6930f1ac143b", "value": 85824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761175989, "uuid": "e985303d-68f8-4998-b05b-7136214c36c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761175989, "uuid": "d50aca12-05b9-40bc-9295-7b4a40ac68ae", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5330eea7-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150587, "uuid": "26f6d6a4-5d72-441a-85c9-7594790e5ecd", "comment": "Malware payload (Rhadamanthys)", "value": "563b9673e76d2df2c3ac043a47e01bfc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150587, "uuid": "2d04e402-2afe-48ae-8353-3aafb20406de", "comment": "Malware payload (Rhadamanthys)", "value": "6ed833c8931fce2984e640b679e7c087548ad198d15bbbc42afb0799cb6375b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150587, "uuid": "5f202781-6819-4499-bab3-ec87f4bebfaa", "comment": "Malware payload (Rhadamanthys)", "value": "660d82c194c75a4c2c101297dea72dc267b0597b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150587, "uuid": "e732e969-abd3-438f-b771-695ebf949cf8", "comment": "Malware payload (Rhadamanthys)", "value": "3c6d0c716fbc38f13a854473125f7df352899d028578b0e3801113d4aa81c9cfc7af877c15553e45b5b2d8d81c175144", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150587, "uuid": "bd1d4d43-d029-4f71-bce2-9df2cbe52648", "value": "T188B31A018DF67BF12614F57CEA989CFCAA4E274114EAB346088BB371E196D5C5F239C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150587, "uuid": "b3cf2a7d-1018-40b2-961a-3c68d4a79b36", "value": "768:GDhd0i7J4sYKgY/CMNfWdKDtXrL1rXoNrg4ycH95AS+/ISLAuAAroQW+FF+Ec+0G:GDB7eKg20o1rcrg4yC5ASII6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150587, "uuid": "1b7f9ffb-160e-4524-a484-a3fbd6852921", "value": 108033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150587, "uuid": "4b5a383b-0655-410d-a109-d4106c33452d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150587, "uuid": "971cc155-5e15-4078-a630-a15ca53abd3f", "value": "invoice-1637482117.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ede804-af93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170651, "uuid": "1e9a1d0f-9b71-4b63-921a-cb2cb39925c0", "comment": "Malware payload (Mirai)", "value": "1c9f5f30a45251d40609b16991b92bff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170651, "uuid": "e74d17b5-e0fa-4b78-8291-e8bfea203e38", "comment": "Malware payload (Mirai)", "value": "6f83f9621bd8b0e62a71359b184969f147b0046328455d84a8f20aa1a7ad0fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170651, "uuid": "f27bcf78-b728-491e-8fdd-f24eba0201c5", "comment": "Malware payload (Mirai)", "value": "b1e5baea45b5b97be5b326070614a3f3e6b231f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170651, "uuid": "2dacdc79-9290-43d1-8194-80870af07150", "comment": "Malware payload (Mirai)", "value": "4470efe2e6039b929f6719f1e10e94d3db617abc8d3537970d2e06142020fcfa4a7a5747054d83040c319e841703a7fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170651, "uuid": "de1b50a8-c4f0-45f4-aac7-4ef0d9700c3e", "value": "T15213F1279592F209CADF41BA20D1B1469614926E7E0DE0EA9FC890A92E19F006F6C3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170651, "uuid": "6857ff28-f45d-45dc-bc94-dee943ea8ab2", "value": "768:/1vN4xLQwhaIc6MYAb1E73u70ewDcMJzZBnpb+CZ+wTerep2VIEnbcuyD7UHQRjr:/2aLd43CwDcMlZBpbfnTer/qEnouy8Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170651, "uuid": "d9a1f40f-467a-4d6c-a74c-2c76cfa02afc", "value": 41660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170651, "uuid": "d4484f6b-f9aa-413d-ba6e-86d857c922df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170651, "uuid": "cc2edeb7-ca33-4d77-9d19-2d079fe12cec", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1108293-af96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761172193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172193, "uuid": "efb8e0c2-49a0-4bc0-86cf-51922dd1fafb", "comment": "Malware payload", "value": "c52b117555e531e89242a9d3eaedcc81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172193, "uuid": "f555f2b7-cdf2-42d7-aed1-586507a68bdf", "comment": "Malware payload", "value": "704772da03060dcc4e2b65817fa2d0baea31ae45984d2b3e0e32bea0a28552c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172193, "uuid": "7fb6bdb7-b03a-46b2-bfd2-5a05c399b28b", "comment": "Malware payload", "value": "cae0725a6db65b7dc217752b91420e4887d39155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172193, "uuid": "855092bb-8a55-4212-8c3d-a4720a238a61", "comment": "Malware payload", "value": "656b655dda8db80d3c3d02220628c28273c4c0e6eb36bd4796011e2148d56abf57e945bb13292ee5e67fff31f380f567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172193, "uuid": "cc921c69-3d19-4530-884d-f0941a3cc2ae", "value": "T159438C5A5B58C407DFAF4F7DB0E108121A70A3821592C6C77D8C51EEAF973820B9A79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172193, "uuid": "f451fddc-2d33-494f-a44f-4c930360efe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172193, "uuid": "ffc42472-eccf-478d-84fd-cefb7d3639fd", "value": "768:jmQZqx1lYcTYbFyfwbdGmLgNDSIzyyAJXbYC1hkOP6dLz205Kpdxyr2Tpdxq5ALW:j0lYP8msxzebIOP8QdxiwdxpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172193, "uuid": "e4de07d7-6ff6-4574-9aa2-b1024a2a0797", "value": 59336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172193, "uuid": "177565ad-4dae-4784-9f72-102f1f21b58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172193, "uuid": "5c7b71e2-8ee3-49ab-a8f4-d8461ce543d2", "value": "Docscan_245984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c5b6e0-af92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170588, "uuid": "48ad011e-7c9f-490f-8b9a-ada43afa8661", "comment": "Malware payload (Mirai)", "value": "7e875441e7f7d5bcf3d3658b7f0642e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170588, "uuid": "dfce7a82-6f37-417e-9052-369e6461a544", "comment": "Malware payload (Mirai)", "value": "70cbe5708a93d91af1b1b63e16c0e1d1a2cfc79ee28c1a93cee1927a6ff7f204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170588, "uuid": "2c643f33-00fd-4026-97d0-d20d8b73e977", "comment": "Malware payload (Mirai)", "value": "e6e193fcd24921d4c229e5318b8188f2b8417ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170588, "uuid": "0ea76a9e-9e31-4e92-b00a-07489c9b1bf6", "comment": "Malware payload (Mirai)", "value": "d8b3c77ce5c049275310ccb1a4b9450206674e27fb3ffd021e11559abd3bde0da1a8ce55b47d35768960ae2b0b04cd45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170588, "uuid": "880b7f90-649e-4797-b76b-58689479f772", "value": "T18CD36CD5E643D8F7F65305B0052BD7364732D83AA026DA53E3B9AD35AC62980DA1B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170588, "uuid": "30b1eae7-c8c3-4931-8f0d-6cc1052f53ff", "value": "3072:IbMONH3pPQt5E3s/ZNb4sHJKHiZfcaE28z:Ib5QtfsCtDE28z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170588, "uuid": "0eb9f098-c6fd-4201-aea7-4b14825ebad5", "value": 139504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170588, "uuid": "51954f85-119a-41a9-b6f0-a47d4d56cb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170588, "uuid": "b28c02b0-0492-4ebd-9a05-57ddb2a1b815", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c9e76d-af07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761110694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110694, "uuid": "2b1b7620-a26e-4bed-89ad-071d60b1f32e", "comment": "Malware payload (Mirai)", "value": "0d50a8691cc87ffc470bf7aaf104980a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110694, "uuid": "1d5540ab-7a58-4155-95a0-35c3afa20c33", "comment": "Malware payload (Mirai)", "value": "714d26a72cd83b1c9c6b4b9556e05cf15825d32f413ecb29614e8161cfa0aba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110694, "uuid": "61b0bec3-0687-4134-8c5f-5038bbcbf339", "comment": "Malware payload (Mirai)", "value": "f747bfb32fbd7a210eefb32bb185eece503cb37f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110694, "uuid": "d36e9402-9c92-4a6f-be46-61f177fece45", "comment": "Malware payload (Mirai)", "value": "4f9308b4c1a473890eb06f4228fd78cd05144c5b8a52b1cf60b5b3c3929794527c2ebbb12e38828253a6655719a75831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110694, "uuid": "0c33267d-a59f-46c9-b5f1-1ee7c8ea392c", "value": "T1E343021352CFD85DD57D41378439AE491462D1FCF0AA89988FE461202B94F3A3F9AF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110694, "uuid": "14a89325-6471-4af7-b229-3d342a3c1c03", "value": "1536:SauT/msmwhIieTIv9sxkfv/HpLJwGnouy8Hy8:SZT/msmwyGsxkPpLJw2out7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761110694, "uuid": "dc0c6903-6545-4472-a366-fdab47c12f6f", "value": 58768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761110694, "uuid": "812e58b7-6385-40b4-b635-98996582ead4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110694, "uuid": "8b2ae9c4-dee1-4c7e-ad72-8355ab11a38f", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e403ec-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130967, "uuid": "190a82fc-1d3c-42e3-a62f-d6fc71abca1a", "comment": "Malware payload (Mirai)", "value": "3d757749e74babb9c9c6653541246b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130967, "uuid": "96a5c4f6-740e-4c1d-895c-6dfe0649186a", "comment": "Malware payload (Mirai)", "value": "719a7dc3992791fa8d03ea20cba8fc23ffd79dd70fb3bf904ac0d76715f18d14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130967, "uuid": "25758c2a-bc0e-4387-8239-9234949fa9a3", "comment": "Malware payload (Mirai)", "value": "63b68cd6e780a5a88f2feed1d854574dff6d2c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130967, "uuid": "f3f90084-a14a-46e7-8f74-847a2474a7fd", "comment": "Malware payload (Mirai)", "value": "c3cbc0ec45b7e733d236d9694b31708f66bb0e29dd20f219fc1b957fc3e1590796aecfbbf03db3156f8d8d5be77c36c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130967, "uuid": "44f69eb9-ea94-4b51-9056-89edf86a09c1", "value": "T1B203F19FC5FA09F7E00A627A5A6A350A084DE68E70675DBF11C420104FD3F8A739536B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130967, "uuid": "70fca6f8-0850-43a6-88b3-bac501d2a0ef", "value": "768:bEMB/N8D7E0EQwB7ky+UPM53I90vZnEgRg5bBmUd6Oz7BwV8nbcuyD7UtQRjx:IM08PnAyS494KgMme62FwGnouy8ty1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130967, "uuid": "0fcbe245-8c9c-45be-95a2-0ff6e6cb2e60", "value": 40276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130967, "uuid": "23e16f63-0955-46fa-82f5-b1fde05d4b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130967, "uuid": "19a14679-918d-49a3-912c-9701a5acce3d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f4a624-af3d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761134086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134086, "uuid": "a4ba51db-82cb-44b4-9f7f-680ccde6e9c0", "comment": "Malware payload (Mirai)", "value": "e064cda6b9120c68538e04e74bc3d5e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134086, "uuid": "f718fba5-6c28-4ceb-b21f-9496ebdecc5f", "comment": "Malware payload (Mirai)", "value": "71a1292174c9a54130f89ce7d1bb8f4bbdb111da162d072e4f266b8984e05ace", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134086, "uuid": "c9c2be16-6595-4f72-8c61-2c6544ad5c63", "comment": "Malware payload (Mirai)", "value": "d903ee34e943f6477f72ffe8c165d0c4c5e03e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134086, "uuid": "f2bcea9e-88ae-4d3b-82b6-803d045e6ca5", "comment": "Malware payload (Mirai)", "value": "f2db006d0a37c61991670dffb251e737f10c423aa264b4a8abc473f0cc609514c22d1cffcfceba9a33ae36c7172e8adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134086, "uuid": "72245e88-20d8-4e2b-ba42-f3353913cb87", "value": "T1E304971E6F228F7EF668873047B74D25A76823DA27E1D644E1ACC1105E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134086, "uuid": "b0547c1b-6516-4524-91e3-742a90020c51", "value": "3072:GuIugLnKfzVLjCtjWduzOGSoOVd2x+vXkur9:5rYnKfzVLW6dyxOWxkXkU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134086, "uuid": "b32812bf-4807-4372-b736-c0b5a366fa28", "value": 173860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134086, "uuid": "63533f1a-77f2-46a0-8a05-22839159ba6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134086, "uuid": "d953778c-c299-4113-8a55-94311aec827a", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2115f8a7-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150503, "uuid": "aec4faee-a522-40c1-9fdf-09943017c255", "comment": "Malware payload (Rhadamanthys)", "value": "e9c69d0b6a5588bde7baf39b35a27142", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150503, "uuid": "430ec92c-7c7c-4e27-87f2-84d7037b91e4", "comment": "Malware payload (Rhadamanthys)", "value": "71b32fb0b94363cf82b0699addbbe9be74e1e8941caffb6afe073a42829bfce2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150503, "uuid": "9b65488f-8167-4fc8-a41e-54128f4e29a8", "comment": "Malware payload (Rhadamanthys)", "value": "0769d7f3d831ab55f1a6a72bf39e3e42449ccbec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150503, "uuid": "fc3de382-9cd4-4bf6-a3ea-50ebfe41e7de", "comment": "Malware payload (Rhadamanthys)", "value": "ff6fb75687f693e4f827bb573820f87808064218e9207ca4356dcd30f8624a7cc92e30b45bd8b91c29475ea1d241e499", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150503, "uuid": "4dffeef1-e967-4e6d-813b-d36bc4c5166d", "value": "T1F7A31951E909E8703162D0CE1FD83EA444C5B672C55C7B8A9B06BF68C35F7969E22CE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150503, "uuid": "7d22b99f-d216-4259-a342-67a4baf7bade", "value": "1536:GDB7eKg20s5nirGre4+1P7krJAAGK5Vgae6BkQWJ+aY:GDB7b0s5ng8v+l7krJ2K5VgN6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150503, "uuid": "24e31816-eacf-46f6-9db1-49c8be2ef713", "value": 105974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150503, "uuid": "ec76d9a7-8cfe-48e0-a826-8e1f69b4deb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150503, "uuid": "55d2f66c-355c-4374-8b92-7d045b1c4c53", "value": "invoice-1637482117.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67494d08-af49-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761139024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139024, "uuid": "328dd2d5-1a88-4510-8b4f-b3483e182c2b", "comment": "Malware payload (njrat)", "value": "765c8789ed45d226bb19a56146b789e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139024, "uuid": "6af3c053-8f1f-4433-b1a7-8086bfa104c6", "comment": "Malware payload (njrat)", "value": "729fcf83579426cac37711a41684e00b76fd901f57ea743a34c72c181acb6e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139024, "uuid": "daaf808e-5f0a-4bee-8105-ee86e42650ee", "comment": "Malware payload (njrat)", "value": "383a209acaf39d5d8b20b7f88ad4f6e47faa2de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139024, "uuid": "027607e0-067e-4c9f-b169-326c6a33e67e", "comment": "Malware payload (njrat)", "value": "4685047bc629232d2c131a3d02423246ec45824c4fb72fcdfc1cb1eccbbe9ff983a68773cbfa5430d2fff68cb1fc4420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139024, "uuid": "eb812f4e-4380-4660-820c-f060da929d8a", "value": "T1A814284AF751C6A0D2288E33D457D5B80B66BC9BFB27FA2B35C4BF922C320449D0B915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139024, "uuid": "ad82eb33-538a-498d-bda0-618e4ac42f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139024, "uuid": "91232903-5172-4415-92ff-81246df1683b", "value": "3072:3Py2I9Mx8HNiZiZ0ED1VRlcPl7aPJpIwbzqBz65/M6If+3Js+3JFkKeTnc:ZIWgNiyj1VRqPRfwbuxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139024, "uuid": "399c89a4-9fd8-489e-89dd-e78dac699b1c", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139024, "uuid": "eb7c6b72-a91d-4837-994c-58e549469d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139024, "uuid": "bee78600-53bc-4cb3-aaed-464d4c351d87", "value": "SecuriteInfo.com.BackDoor.XWormNET.5.20181.30066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5e7ebc-af22-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761122148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122148, "uuid": "9d521943-805c-4f4d-8f4c-8da5a224dea4", "comment": "Malware payload", "value": "2acfdfbfc4058180ae501512590eb3a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122148, "uuid": "26b9defd-31b7-4864-8cb7-bd7cf48bf214", "comment": "Malware payload", "value": "74669967454c7e9b15e3efeffbf00ab75031959b09dbd13d33f93be132f1074f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122148, "uuid": "280b4175-e084-472e-9469-76390fa371ff", "comment": "Malware payload", "value": "5dd16ff6e09c98ef6676af14d0c43272321d9725", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122148, "uuid": "d08d7291-2c2f-47de-92bf-e04ac66552b4", "comment": "Malware payload", "value": "cf8c5b1fe32d06f596095c4920e340eb6e07dc6a6e167a7650e4aa9c700cbb92de0a4de6a638f05d05d0ef030da58264", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122148, "uuid": "3c41fc44-52a9-4830-a5d5-b2dbc1e0bf44", "value": "T112254B20D92847AE4E972BDDFC4106A2CDBDC604652740FCEBD90B8D62064ECE77E679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122148, "uuid": "719aafff-8ee2-4628-84d4-e792bd051bbf", "value": "24576:2W/kSYAkt17BRJuPEBmCb2rnP4UdhkLydDstLgZWk:2W/kSYAkt17BRJuPEBmCb2rnP4UdhkLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761122148, "uuid": "9bb7159f-0c6e-46a2-ae05-1d15c36a4d00", "value": 1016072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761122148, "uuid": "1392c513-61eb-41e0-ab8c-4e9286e03386", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122148, "uuid": "1771fcf9-1259-4f3d-b582-414fea858f35", "value": "Final_Order_Confirmation_for_PI_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec0939-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1761113267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113267, "uuid": "39a237d0-e0e3-42cb-9788-690fd57a620e", "comment": "Malware payload (ConnectWise)", "value": "0aeb7766455a76eeeef138928de6f879", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113267, "uuid": "3686b12b-6db0-4ac4-88a5-75c2f47eadd9", "comment": "Malware payload (ConnectWise)", "value": "75010da01904bbd5f99c6907389138c81d2cd3963a3b966ff1ff806497e96195", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113267, "uuid": "ba90b442-572d-4c43-a053-af2596c2d818", "comment": "Malware payload (ConnectWise)", "value": "aebe900e32f30bbed412b70801c7b238b2ffdf49", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113267, "uuid": "34c73c89-7087-4552-b551-d2a08181e8d9", "comment": "Malware payload (ConnectWise)", "value": "eb93c5a1c1465150f86b6077e3af6e89a404c13ea7f4f577e91f7c6cad62ce830c2a1599b23f383f056333d0166bad25", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113267, "uuid": "3a5925b0-0f92-4dc7-9161-9c79b4b85c9c", "value": "T13AE5EF01B3A44136D5FF0635DDBA66229B75BC190364C7AF57C879A92E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113267, "uuid": "08007936-b3fb-48e0-a399-7e37632587cf", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113267, "uuid": "9e339536-de8f-482a-9aad-7de8c94054d6", "value": "49152:3jET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1g4:zb16Co69eWb0pnGpYmnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113267, "uuid": "5c422754-4f40-4a20-b6c2-15b6dc245f8a", "value": 3130648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113267, "uuid": "5ca1443f-dfff-4e8f-9732-cecc654204cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113267, "uuid": "64a2d5a6-078c-4497-bf29-af05faf9862a", "value": "75010da01904bbd5f99c6907389138c81d2cd3963a3b966ff1ff806497e96195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a490366-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149633, "uuid": "e6dab424-2b21-4417-af09-ee98ac28fcf0", "comment": "Malware payload", "value": "5934ae255fbc9714f5d2db922bc2a6d0", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149633, "uuid": "eeaf808f-ba97-47ef-8d02-539214fbf7f9", "comment": "Malware payload", "value": "756660ffd70f47c468e80fae66046f283b2dc80a2e7e084cfdd842fc45e3aa88", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149633, "uuid": "9e19b1bd-e0bf-4fb6-a4ec-acb094c07a03", "comment": "Malware payload", "value": "75758824af97fbc1f308ba73888b276d065abe14", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149633, "uuid": "0c982f3e-df8d-4de5-b5e8-58ab325df200", "comment": "Malware payload", "value": "dd88f418184d6e82bfa8c33de30bdee3ae27c8548c47f7de69c57d6644b0f372a1fd7ad8a3aa45287c93b1f7d2237aba", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149633, "uuid": "4b562463-9ba7-4180-b451-0416ae61cf01", "value": "T1FD919323CCD0896F46F3405B4DBAA274FDE28937490D3D98F68E4046AF8625D8362C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149633, "uuid": "502d98a4-b5c6-4a8a-8361-0591169ece20", "value": "96:kXZIhrr6OxXYX6bXv4L0yXEXIX2z1C4aX2NR6lX3DX8c8JYT86:SofBt+6TYByu2hwiRc79L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149633, "uuid": "b6ce9eb0-cb7f-4cfb-ba55-67e204f62861", "value": 4506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149633, "uuid": "f70e27cd-5207-4472-9b75-0e81dc73a19e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149633, "uuid": "d57bd3ac-1f72-4960-bb4d-a2cf1be2105f", "value": "756660ffd70f47c468e80fae66046f283b2dc80a2e7e084cfdd842fc45e3aa88.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ccc392-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149627, "uuid": "5531c0cf-68e2-4f2d-9379-4cd058234476", "comment": "Malware payload", "value": "db1abc26061cbae6404ba9647bb90ab7", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149627, "uuid": "74ec9d42-fb71-4ee0-88f7-5685c580dd64", "comment": "Malware payload", "value": "7643537e75d509d52e37cfb1e44ed2c7685749af897721d631e97d3ea630d067", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149627, "uuid": "17c1575d-9989-4034-9d1a-0b3047efb942", "comment": "Malware payload", "value": "1e9327bc956080eb7456b4fc8da2f4de8fbccdff", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149627, "uuid": "f8bfd9c2-0d91-46cc-829e-8043fe92f14b", "comment": "Malware payload", "value": "b0912f40415b5b98ef3ac7b4d9bd37bfcb87445b4bd55dadae03b6d8cd811203a064d7ab0b27de7f4cdcf4e54d2a32f2", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149627, "uuid": "d12a6787-0437-41a5-80f4-baa60d5ee60b", "value": "T1F5A19533C840A55F4AF3025B9EBA9264FDE6493B4A093D90F59E804DAFF611D8256C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149627, "uuid": "47c0d16c-77b3-4c2a-a2df-35cec181303b", "value": "96:dIxap8Q4Rczd+G6fzhaLMYGDfocY+5q8QKc8r0YESxVJN:dIASQ4R+d56rhaLMXDwcxw9IZESn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149627, "uuid": "5c772254-fe0e-40a2-a73e-419bbf8fc246", "value": 4694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149627, "uuid": "6c8186f0-db78-4002-8369-4467b5cc5fef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149627, "uuid": "6f9c56c8-45f5-47dc-963a-8bde71bb7b6a", "value": "7643537e75d509d52e37cfb1e44ed2c7685749af897721d631e97d3ea630d067.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e19e3f3-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761138257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138257, "uuid": "65df41b4-8aa6-4675-ab9a-20dfbe678ede", "comment": "Malware payload (a310Logger)", "value": "be0c77902488097202cdb5123dc4dfd3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138257, "uuid": "bc7c1b85-5215-451e-bad2-8ce8c17edf21", "comment": "Malware payload (a310Logger)", "value": "76f6c3dfccd81b1324ddfef44d931d296ead4767d5844d51d5eee6f35c8366f0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138257, "uuid": "4b182b17-05e6-4339-99c7-64eda01f0677", "comment": "Malware payload (a310Logger)", "value": "bb9a0b2373525fba60fcdbb3d34427686da0fd6e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138257, "uuid": "477efa96-9d8c-4b88-bc3b-875cb5389e83", "comment": "Malware payload (a310Logger)", "value": "fabb9ca331e33cf20d4bcc1eb58bdaeaade8506a74fa8c2f3426faf282c6e43b17dccc0e7c181052d10b0a5aee26d9b3", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138257, "uuid": "72b18301-d4ff-47ab-86c6-a90dc3032af7", "value": "T18AF40244672EDF12E8A25BF04AB0E2B52374AD9DAC14D3068FE9BCDBB079F141518B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138257, "uuid": "c95bce6d-96e0-4c2b-bd44-49fbc3d07059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138257, "uuid": "36ee5786-4fd6-4853-9cc1-a7f9a27a4d6d", "value": "12288:Laf75BWEw/ugQQ3Ht/E3MVrngsN8q0CxuY3Zlou2MCKGpSJ+:Laf7U/x9d/E8lnbDzuY3ZloiR7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138257, "uuid": "4a95c3da-287e-4f1f-b8b9-22aa9ed069f4", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138257, "uuid": "b7f04cd4-5af9-4709-942c-c7ede9e2ddcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138257, "uuid": "502663a9-f4b2-4a2f-a266-8d12a275d17d", "value": "DWG-00141 Malzeme \u0130stek Formu_21102025.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980e31d-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761150249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150249, "uuid": "61744753-2e3e-4af9-b24a-effd7b301053", "comment": "Malware payload (QuasarRAT)", "value": "3f7812851aaa169facde987dba81640f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150249, "uuid": "fb68a9c4-d59e-47be-ba2e-dfa699a66b9e", "comment": "Malware payload (QuasarRAT)", "value": "7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150249, "uuid": "70d433ab-f0df-4e22-a9eb-c53f07f84085", "comment": "Malware payload (QuasarRAT)", "value": "d6b37b1fdc0e761fa46b4fe40bee17209a25941f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150249, "uuid": "09a8e3d8-387d-4492-bac8-e7fb81ced7d5", "comment": "Malware payload (QuasarRAT)", "value": "55ba3fed45449ca9e15422777042ab1e7cc92dd6ab52eb7ce35f6bf6eb83c947ab8bd18f78df23f8d61e08d0ddedeed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150249, "uuid": "4a263200-6b41-4456-910a-43ed33ab65ef", "value": "T1D4757C5077AC8B36D7AF4ABAF4B145050B71E607A163E3AF44C8B1F91DA378299103B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150249, "uuid": "875a5c5c-1430-49fb-bee3-9109bf395f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150249, "uuid": "d1d5ae75-14d5-42c5-8268-4aa2fa50512b", "value": "12288:v2oiHUvXRJgRD1sdJ7GrUnxa1eoUztQd7zU4GdUtS+gZ/spbDMfX2NF1ay:vsHUvX1ileoUKNthbmXPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150249, "uuid": "dd4b49af-4920-4948-977c-39493c72edfa", "value": 1564160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150249, "uuid": "056b86d3-efda-4c1b-9b5b-4552d9b38cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150249, "uuid": "6754adb0-da7b-42cb-95c7-80c42b359f02", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db1c59a-af98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172804, "uuid": "6f22ac1d-e56e-47e4-b464-99264e46c790", "comment": "Malware payload (Mirai)", "value": "07d61414d4d61bdc7241b76f2716242e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172804, "uuid": "4fe4884f-07b2-4b00-99af-533a297fe506", "comment": "Malware payload (Mirai)", "value": "78b606d0d6ef1f0bc32a1a06e39a6a76a1c6ebe094584d4962ca386e8464ff57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172804, "uuid": "d5f648aa-a26a-480a-bfee-8b93b83d9f5e", "comment": "Malware payload (Mirai)", "value": "24b64020db21a59d3668e9c3f0307fb498636b04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172804, "uuid": "a2b5e9b0-cdd2-458b-9355-3d81e6c17cd0", "comment": "Malware payload (Mirai)", "value": "4886c9344ac5ee2412db5b4774426d48132f53e9e74d7f43fdebd3f5044b2eb389a6e7582deecd4118aaf4159eb160df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172804, "uuid": "fc3849d3-3829-47b8-9d26-ce3bded17e5b", "value": "T1C5A31952B9828E11C4D512BAB57E418D371267FAE3DF7223CC245FA03B8649B0973E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172804, "uuid": "f675d9f9-e29d-4505-abc4-452909283975", "value": "1536:utnA5GgwfDay7l0DI01G+wFdAwUVBbmD6lmdEU7FTsdzwIciSehJcIZ8jRdhQzqw:wgwWQXAndmG47ehJcIZ8jRdhQzql+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172804, "uuid": "cd5bde3d-9a73-4772-9794-cfa54910eb9a", "value": 97928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172804, "uuid": "63c87946-6370-4c3d-a5df-6ea7f37d8abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172804, "uuid": "6f4eabbd-9ac6-4e4f-8cca-6f5bc23057aa", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9464bc20-af4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761139530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139530, "uuid": "c0ab4b17-15a3-4097-9ef6-16380130cea5", "comment": "Malware payload (PhantomStealer)", "value": "f7c874c01d872b481524f6bef92696e1", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139530, "uuid": "7bcd233b-29b3-4b79-8186-51b24fcc31e3", "comment": "Malware payload (PhantomStealer)", "value": "78bb8cdc4495a8b1d121e1d52a25c8908da661192bfb9ecaaaafd6ebbf2424b8", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139530, "uuid": "59bfd4a1-8230-4816-8f48-74258bac6a7e", "comment": "Malware payload (PhantomStealer)", "value": "bf09b973eec6f3abf9b7e67539a9b37c652b0afa", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139530, "uuid": "54dc4e1e-768d-45ed-a518-9418ae8d2a00", "comment": "Malware payload (PhantomStealer)", "value": "fdf1d91fb638fe2f566fc529fc843b440a79bd96a2882fce8723231ba4794411b4a820dc249c5bbaa2185077d13ff150", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139530, "uuid": "ff33c031-74b7-4987-9ffd-c3eb99ed85b4", "value": "T19BC2F111F6DDA0CAF342E1F24D108216B837D454B0D1C69DA5AB832D9D9F1D8A78F9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139530, "uuid": "3b1bca16-ad2f-41d7-bf1e-eaac30d9f6a7", "value": "768:NI1HcGcx7tKI2w9GsYDAyrPIrH1S0EwjxGhyisISsTUcu9:sHchlEtA4PI/dGhyhISCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139530, "uuid": "747ddc5f-bdc7-4258-b062-2cf3a2d86df1", "value": 27157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139530, "uuid": "45d272be-9ce6-40f1-81d0-384e3d1173d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139530, "uuid": "417d346e-bdc5-41f7-a404-60cc8eb774be", "value": "PR 1008710334 SDX700E.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117cfb09-af39-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1761132008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132008, "uuid": "175ad829-aa5d-4f14-8a6a-41d55adc5649", "comment": "Malware payload (DCRat)", "value": "936dd1617a968602a73aed4bf055f484", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132008, "uuid": "66e9e451-6922-4f2c-bce7-2eb84d6cbb00", "comment": "Malware payload (DCRat)", "value": "797cd41c6e6d87f7c2358e094d969e461cc5623d71a5cd9ca504aaf5de62a35c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132008, "uuid": "3be71c13-214c-447c-bf88-09e393934bde", "comment": "Malware payload (DCRat)", "value": "210eb0e636ad11310ea02824f6e3aef1244b6a24", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132008, "uuid": "62bc89e6-ac20-4fd7-8500-b29d5d06923a", "comment": "Malware payload (DCRat)", "value": "6f4946f60f001d732203b51607174cac2786641f95505da66a0a20b99f3c6b2e406bd6254cc028e4a1f722291b2b1fc8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132008, "uuid": "3146c416-7f6e-4584-a56b-7f580d95b8d1", "value": "T18D95BF0AA6924E32D3A157318597563DA2D1C7223512FF1B3A1F10D6AD4BBF18EB21F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132008, "uuid": "3064a6f3-af1a-44c2-89c5-e2de91cc21db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132008, "uuid": "3385de14-2afb-416e-96d8-c623319bbb63", "value": "24576:JwO8k+1KDFhkJeayqtnVw2bji1HpPMbSiJxnAkC4/870gCBCKS8GMld1YcIV4y:61mZqtVwD1dBiJGxe/T48xTYcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761132008, "uuid": "da3da92f-487b-45d6-98d1-7f9e5f774a00", "value": 1914368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761132008, "uuid": "19f289b1-36f1-4c2e-89b1-3a3d47c93326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132008, "uuid": "959ca052-1250-4deb-8c45-3a9f772db0bb", "value": "936DD1617A968602A73AED4BF055F484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44720e96-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150562, "uuid": "d873b65e-cc34-4bcc-b263-a3d0ad714a65", "comment": "Malware payload (Rhadamanthys)", "value": "897fabf1d462b04b66c20cd11a31953b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150562, "uuid": "0bb8c783-3275-4b1b-8271-d96313ae5a20", "comment": "Malware payload (Rhadamanthys)", "value": "7b63a3c33c2523c15dd607983fb346f4a81e466cea12d76e458f2f70371ea2ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150562, "uuid": "73f80372-d938-49af-a56f-0c0e3601dd52", "comment": "Malware payload (Rhadamanthys)", "value": "9d13faa8a18c52a962214ca3f87177fcb26c4c5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150562, "uuid": "b70dece1-5f62-4638-bd12-4cd88b3879b8", "comment": "Malware payload (Rhadamanthys)", "value": "a0305a5fc72c039ee96790039bf0b02765fe4ae47637cdc9bd37a0c32879fe4317dcd9b80b07e0a685c6fb5d376552a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150562, "uuid": "e0d1f5c0-f997-4fe1-bf0e-bf4e810d1300", "value": "T198A3FA4EEE5146EC7449B170B640C1FBF8459E248B6130AE9C7E392835B36ED69D1EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150562, "uuid": "72e24aa2-92e0-444f-baf7-f2ec87106ee9", "value": "768:GDhd0i7J4sYKgY/CMNfWdQ8eTtUNmvUpIcqlvow8tAma5eg5tDlAOCprXKU4w+rZ:GDB7eKg20rr6rKt4L/7Ak4z6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150562, "uuid": "941132bd-04c3-4327-a601-262bdea371a6", "value": 105403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150562, "uuid": "116f9efa-682d-4f66-bc41-0a3734a7aa63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150562, "uuid": "7452348c-8eef-4a60-8276-9dfc8127428e", "value": "invoice-1637482117.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb019be0-af60-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761149070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149070, "uuid": "2a39d198-3e60-43c5-ac2c-64fec8168dc7", "comment": "Malware payload (Mirai)", "value": "f28ef3fe1e06dfe41fe7a18757414479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149070, "uuid": "918e0901-f10f-4c06-983b-1a419f05cd18", "comment": "Malware payload (Mirai)", "value": "7bc0bcf6a3180803b8d7f2d8ec226c119a0151a700b91cf9308ff260d7140958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149070, "uuid": "687726a0-a077-4139-a37d-1eec37172858", "comment": "Malware payload (Mirai)", "value": "997c784d08899d27e201fa604b8f32364334fc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149070, "uuid": "8e2ca2a5-0190-44f6-b301-cb7a83d85cc1", "comment": "Malware payload (Mirai)", "value": "22f7d59a6dd3e09b278cbc6cbd68bb6b914d7c34e83249f68dbd0a9388b1255dbea1a24b037d8d9f6a27b201ee352886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149070, "uuid": "cf6e359b-2ef8-4411-a619-5b49dcf6d8c5", "value": "T1175301E0856787ADDC9ED1B3E52B2F140B54C3AE7958D8E86A507807B007B861F748FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149070, "uuid": "1217b4cb-e4f9-4076-a1e0-6c9c11614199", "value": "1536:r4/jEmMMLVRP/pEuQHVZBu2+Vm6CR+AWiN77snouy8ryI:r4/jpLDPBEnHVZBwBCcAWimoutD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149070, "uuid": "1a5e8fd6-9c35-43ab-a168-c14bd5435c1c", "value": 64156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149070, "uuid": "a77f5d55-e7da-496e-9c5c-57bc768b2583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149070, "uuid": "9f9b8583-b781-452d-8e71-1504b0d49e39", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b36f9c-af74-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761157470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157470, "uuid": "a75083a1-3d30-4fd3-8530-b133c99a02ba", "comment": "Malware payload", "value": "465771837a2a6163880e1fe16dc67ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157470, "uuid": "bce8671d-b43e-4749-b027-f189f892ef5b", "comment": "Malware payload", "value": "7cc2defea66c8313e444ef574d0f77b8331513dafff0feb60a8f0fe2c804b92a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157470, "uuid": "56fd0ca8-7fc3-4632-83bb-40a4cdef8394", "comment": "Malware payload", "value": "eeb7c25119f9136f504a9689a979225c03b4d659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157470, "uuid": "6ed9ce89-f07a-4072-8df4-19456e3c6804", "comment": "Malware payload", "value": "7ce91df45f2cbd334dd50d5e146a76dde204524df9ba08c63fbcad90b824ca0552a498701e0a291d63e7f689f17713b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157470, "uuid": "e9623316-93e3-499b-915a-9914dac7253e", "value": "T1ACE46C9DF783D4E1F66340F1024ECBF20534A52AA057F6F2FB452A6778727A22F15229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157470, "uuid": "a046b26f-1f3d-4766-9a7d-c97bccb5cba1", "value": "12288:K9wy7GDKMgBMh24h4piQRvQbUX6sRihi0Y6hSpw7ZPcuxO/vgyg+hxFhr1Vt:K9wy7m1g2h24hpNsRihi0/hSpw7Gu4/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761157470, "uuid": "f8f39390-ae54-4d9e-9fb7-08435770f052", "value": 706676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761157470, "uuid": "7df12ed8-c6f5-489d-a7c3-745f542d133e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157470, "uuid": "d69cd2d2-bda2-4f9e-9dd9-1bae377dd679", "value": "i686.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc72ec72-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137986, "uuid": "6686ded6-b4d7-4777-b816-bef2f07b3747", "comment": "Malware payload", "value": "599161e66c1fc12760ee9a4031a35b7f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137986, "uuid": "74349010-463a-4008-8aed-5637b005b9c0", "comment": "Malware payload", "value": "7e5d1704da8e9a79667e4270a0e9c004bda4a3fd8eff03b10ab4ecdc3f29e8a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137986, "uuid": "3e9f4e53-0d48-4faf-aa46-af653b345420", "comment": "Malware payload", "value": "d96b16fea1c2719b3c5479dcb0a9a592c1edd281", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137986, "uuid": "974e8371-055b-4e75-9e66-cd88caeb1751", "comment": "Malware payload", "value": "7eb5e168a05d2e73581369670f31039e3f7be6d1391be609e17fa07448133ae5353a3188d074d023512db1e1d7932ca0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137986, "uuid": "bd048154-b012-416c-adec-0acc15ccd917", "value": "T1F611CEFBF2241E72360C8B75F79D6171754A00EF948C3C98A16B48350F1D90872D86B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137986, "uuid": "99bb7e67-5a8a-493f-adfa-af3efd9e45c8", "value": "24:uCzH1yGuROUgjHs6E51yGSkVZHIgYyc+scQcOyOWl2:P1ytgS1ymPIgYyTsrfHW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137986, "uuid": "57235b06-5707-47a0-a30c-bf567603b454", "value": 997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137986, "uuid": "584f0e7f-e32c-4c21-84dc-21cdf44687f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137986, "uuid": "6fff2129-9d07-41b1-9746-9d2c9f2b7490", "value": "sigma.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1685a19-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761113379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113379, "uuid": "2b1dfb30-b289-4ac9-a2d9-8bd13835a26a", "comment": "Malware payload (RemcosRAT)", "value": "b419837639373686ba39a86712366216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113379, "uuid": "7eca1ff7-250a-4130-9b6d-c3f0ada37648", "comment": "Malware payload (RemcosRAT)", "value": "8090d733578327c6b42ba49b4dba0ac43fb8cbeffb0d565cbd6609b93e13dd5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113379, "uuid": "ea570bed-28d7-486c-9346-6bed3690afc0", "comment": "Malware payload (RemcosRAT)", "value": "641d1106c953b5a4c46c74dea48a14423a26fb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113379, "uuid": "a7ebac3d-6790-48ab-89a1-5f5b1c114c2b", "comment": "Malware payload (RemcosRAT)", "value": "e6764fd0aab105bb38d169227f87f490466b39a5798f346593f6cf3a64b44cc2b40b34a02a18ced8aa0988b584d3f8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113379, "uuid": "b5d207f8-ada7-4e47-bc94-ea10c2ed5d68", "value": "T18B35F14F7E04F89EC84395735968EE7C61242C6EBFD6810389EF38DBF93D94699140A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113379, "uuid": "165995ee-54ae-4f47-b656-c98b74a7d7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113379, "uuid": "a4e0896e-3e8b-498c-93f1-995a96d56c44", "value": "12288:0edYL+nW5/0RwdOxbW1RCDPz278KtmqiTnN7vhAP0ZcJA8HCkIDP2xA4rAm04izo:0edYLYq/IAbwKIqir1pA9JA6CkU2xA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113379, "uuid": "1149795e-0d84-4ef4-9975-79ac7fb3e59b", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113379, "uuid": "816143b0-b7b7-4b57-8cf9-5cbd7ad317f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113379, "uuid": "42940694-509d-40aa-817f-38309c2004bc", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70b25cd-af94-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761171397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171397, "uuid": "04b0ac97-0e8e-4c31-8ea0-39d378e076ff", "comment": "Malware payload (Mirai)", "value": "c014b397253f15fc6e6c7a62d97dc0d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171397, "uuid": "aaa262ff-04cb-4b5c-86b6-16ba5ae0e36e", "comment": "Malware payload (Mirai)", "value": "809401926fcb38d01dbd1816b0a8206be7a65ec2be0d882f031bfbf540d6bb8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171397, "uuid": "cf3a00b1-1af8-4e6d-b561-5c28ed28e96a", "comment": "Malware payload (Mirai)", "value": "fb9adb25be55e490a75aee05d0d6371d960a7725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171397, "uuid": "6092240e-8ab4-4bc3-827f-d615e816a98f", "comment": "Malware payload (Mirai)", "value": "efab3c094aef53f4ab1a92fff4a1059db791f6f7c244f4674e4a434c1b7b85d2d7b1ed5a7d838232486c9660367388b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171397, "uuid": "830accb1-694a-4bdd-a483-4b741e698a3b", "value": "T148F31945FC508F27C6D522BBFB5E428D372657A8D2EE72039D256F24378A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171397, "uuid": "253403eb-4202-4c38-bbcd-b19274129967", "value": "3072:kwB5ggGZ13k1DV+UdG/h1y4DUwkChmMJt5+LeeRVNG:kwvGL3hOG7y4DhkChmMX8LeeRVNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171397, "uuid": "0aaa84f7-bc03-46eb-b683-f474a7549980", "value": 157476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171397, "uuid": "f406cdf9-4e2f-404d-b561-31ef814a2da1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171397, "uuid": "04bb5ef1-87bd-43f1-96f8-804cdb809817", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b21b12-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150464, "uuid": "8575d855-cd75-46d1-b133-904fb9020f91", "comment": "Malware payload (Rhadamanthys)", "value": "c0f645ed410199a52266c128be5bb6c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150464, "uuid": "2212f68c-733c-4758-bb8e-a1bab13899f9", "comment": "Malware payload (Rhadamanthys)", "value": "80964f7d71c7daf5bea9804f79958ed40a5c428dde2f994a19089a885de15f3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150464, "uuid": "940aac29-8957-40cd-9714-a053a86a7e3b", "comment": "Malware payload (Rhadamanthys)", "value": "f9f52ffb6a260648462022f5345034e39ae44c71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150464, "uuid": "80a9bba5-9d2a-47e1-bb91-deecb3373b9c", "comment": "Malware payload (Rhadamanthys)", "value": "4b37cbaf28736e5e080045fa665c4f80a088ecaa3ffa2bc41de93d01ed6401cf889d4bb0d386980456fbfd4a46e7ecda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150464, "uuid": "2deb2e26-3896-43a3-8262-030e4815d3b1", "value": "T1D393E9107F861CD8052D312CFFD014F7A84D584FC6AEA399992FFB31579DB289A5B482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150464, "uuid": "9cfaef1f-b187-46d5-86c3-09ba358d14a1", "value": "768:GDhd0i7J4sYKgY/CMNfWdsS3+zGDrXIUrCG/DHukAQ7i2SLAuAAroQW+FF+Ec+0G:GDB7eKg20nrzrCG/ykAQW26BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150464, "uuid": "e7c33d0f-90ae-4ee4-ad2a-dcec43e14727", "value": 96820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150464, "uuid": "ab2e35c6-4f8a-45be-805b-a72d0b430446", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150464, "uuid": "ce0937fa-779c-424b-83bb-7ce9995e3659", "value": "invoice-1637482117.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b47f8-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134941, "uuid": "c88c6e1e-06fd-4d72-aa14-00e119a8af18", "comment": "Malware payload (RemcosRAT)", "value": "5d0ec679f7252a9e57457d9de44ebdea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134941, "uuid": "51626ffa-fa4e-4d62-8d94-5126ae41cebe", "comment": "Malware payload (RemcosRAT)", "value": "824a377b1bc9a5b29c829afb60147659dfc313f3d225d7c30e1c4136771cfb5a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134941, "uuid": "b48cbfe6-bc7c-43cd-a6e6-40eecd0e10f5", "comment": "Malware payload (RemcosRAT)", "value": "8078d2316cefa5fd4cd6d131e096b5b822527a71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134941, "uuid": "fa1ab667-3028-4955-acd8-467e49232341", "comment": "Malware payload (RemcosRAT)", "value": "58a1a6eb9a8999ec0e8e42581e0266aac7da697045f6e04a42afc444aa378b51d9a51410b4312ac9651e1f9843daf444", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134941, "uuid": "1c05d3f9-a67a-43d0-9854-af42ad90f987", "value": "T1D125BEA49CA8B0DE63B9A56519F7FC45621F1B53ECB2080E327473D06835920BB633ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134941, "uuid": "f7c4f7df-d11d-4b48-843f-0b67c46ae62f", "value": "12288:/wSZFv8rj4tkFS8+0WA2V7C7Y6KFVVY6tbjSrMWbF51gvv4t7mfaod:YOU34aFA+ps6gVY6tqrMwz1gvv4t7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134941, "uuid": "783974c9-b871-4a87-b176-f3ef8ef70627", "value": 997836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134941, "uuid": "83d16145-52b8-4d1d-9ec4-0afe98a947fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134941, "uuid": "a01343e7-c49a-4114-9e7b-319daa2922d7", "value": "Doc_485648465848465748465846584.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652a15d1-af83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761163932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163932, "uuid": "5415ad40-8357-4b30-a6c1-4f5915ec23ae", "comment": "Malware payload", "value": "168fe42bc6093c07bca1047673a8e20b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163932, "uuid": "7e5ec5c1-56a3-48da-8a48-4094bceca764", "comment": "Malware payload", "value": "82b7e0fdf753f414ebeda554405ee44f7a8a875a73ef18a1d70ddac2acec4ee5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163932, "uuid": "3235c04c-8ff5-4caa-b79d-df37e41613b3", "comment": "Malware payload", "value": "0806a7ac17554f7c41d3ce5f42c572f27417b6f4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163932, "uuid": "6d50fe6c-d649-41da-a748-6d60d69169ce", "comment": "Malware payload", "value": "36f494783dae6b0c87f0421a65f18ac0633ed1c1b58c7aa8d9f7e324d3d213e59856a885b7179789e7bbe4a0309d96cb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163932, "uuid": "454ddbc8-ad78-4ce9-8533-e619e7c02f9b", "value": "T1DA21AF145BFA5721F3F30E3658E1E6399A37BC03E942DE1E0085C1481973B92AD65F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163932, "uuid": "9a0551db-7cf5-4769-94f2-5a8d3bc4dbff", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/x8OK2YqVwOtab/cm:8IWJG/yp3xHBvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761163932, "uuid": "1c310a33-1325-41d3-8231-a19eb1aae114", "value": 1435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761163932, "uuid": "a33833bd-8101-4ee8-911a-afea3e5a0cdd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163932, "uuid": "8644f2eb-cc80-4bb5-8991-e5ba3c202703", "value": "RE-564038482934.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e04c080-aefc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761105991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105991, "uuid": "dba1d9f7-988e-4834-a5b8-f857df249393", "comment": "Malware payload (Mirai)", "value": "2bfbc8c9310c9fa3afadb99eeaa2ac47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105991, "uuid": "36b6b534-8f71-4e57-83f5-4e278a7575d6", "comment": "Malware payload (Mirai)", "value": "837d422e839afbff1903995fceba6ab3cfe37f4021d5e1f23ced0e838492dc72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105991, "uuid": "99283503-875b-44d0-a032-27df21e3669a", "comment": "Malware payload (Mirai)", "value": "fec5357c7ea3afe1903b54a83f54661f99bf197e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105991, "uuid": "d8249f36-f23d-4d23-ab82-4919e02ab9f8", "comment": "Malware payload (Mirai)", "value": "e07a167ad572a84a6538a8613d593a72cd4bdcd9c7abe0426a5bbbf5f99179d1c96ca276b8a75fe1dc285d2b1338d189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105991, "uuid": "cabfe11b-6b54-4ef0-be7e-c1729339d415", "value": "T1AB636C33E8178E95C00704B4A1E65D750F13FAAE46632DF3AEA58AE16813DF8B415FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105991, "uuid": "d9bb3b7e-536b-4e5e-af1f-c64c0b4569ef", "value": "1536:haFzF53xPG5Z+MULjkDfF3q8HMOmDCVydhQz2I:hqRG5Z+MU8R3rHMOmDJdhQz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761105991, "uuid": "e8543ae7-8eae-4943-9017-4b89002c86ca", "value": 69276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761105991, "uuid": "6da0cc02-de81-4b8e-9b16-2049425b7fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105991, "uuid": "992ec8da-f5b8-4558-a4e7-470b828ac40e", "value": "kwari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74b2055-af56-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761144796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144796, "uuid": "1b44d354-1a2a-4900-8062-c16fad948c5d", "comment": "Malware payload (RemcosRAT)", "value": "e3ba037d1ce0b3a61e021f5932125c1c", "object_relation": "md5", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144796, "uuid": "c3365e74-fffc-4b6b-a407-eacec36a20f5", "comment": "Malware payload (RemcosRAT)", "value": "84b334f4595f818c43678dd8047022d45ddfd8cc721fb7a57f539258252b5481", "object_relation": "sha256", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144796, "uuid": "603b3ebe-4dfc-4c74-b30f-29387fd856ca", "comment": "Malware payload (RemcosRAT)", "value": "dc75b2cddfa613fa86bb439e225acd669deb1067", "object_relation": "sha1", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144796, "uuid": "694234ba-d0e6-4766-a6c1-833f48f68b95", "comment": "Malware payload (RemcosRAT)", "value": "04dbe09af69a5f4e0837c90b5136c9f3ef45c45948e58a867def733ec38dfe1546155908b8f30afab46d5d2b58df258b", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "Bper-Banca", "colour": "#972277", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144796, "uuid": "b61655bf-a391-4efe-944e-cf3f8ad18bc5", "value": "T135A5C006774664EDBF08106A0D14AC851BFCE5AD7A64C388CEF236F48ABA1555C38FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144796, "uuid": "b5dd90a4-3d73-421c-8ef8-b657abea01ff", "value": "24576:Jahom7G0OiCCzx3Xe9acsKL/5LogmnU7uPPIKX/R/8Mn5ShanDA1zv/XNxX3zXkY:6d8OxRdhSY8nTryc5T7c2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144796, "uuid": "380d95df-65bd-4a75-8252-cbbdecde963d", "value": 2153403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144796, "uuid": "962d2b42-72c0-4b92-8ee9-ab96f63b2644", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144796, "uuid": "60bc15dd-1f51-43cb-8620-aa3c75b4fa91", "value": "u5wgnr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c9297-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130969, "uuid": "2e60e483-c59b-468d-bed7-17b948ceb429", "comment": "Malware payload (Mirai)", "value": "d389642921e040d670c1cc81fd27b89b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130969, "uuid": "f2febf98-646c-48e2-9058-daaa5b74a27f", "comment": "Malware payload (Mirai)", "value": "8525788abad614f003353eea8d1e895d36f99098e173b234823ecfb3f0b5160f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130969, "uuid": "bb43e06e-db8f-4f04-b877-d887130e670f", "comment": "Malware payload (Mirai)", "value": "80365e4899de5bd551c5a527b60947d95ff4e2f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130969, "uuid": "87748f6b-07b9-4361-905e-8203cde4657d", "comment": "Malware payload (Mirai)", "value": "7413b525bce6352d8ceec5d001e78227b41c2ab6db6f9afec00be4e4e3841addfd2d107cdabc242f311c694fa6eef5a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130969, "uuid": "1ffb7e8f-8530-420a-b079-6f952fe9b9be", "value": "T155436C41B31C0907D0635EB0243F4FD18BAEEED122E4F68569AF9BAA8435E731546E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130969, "uuid": "c44dc897-7cc9-4eb0-b455-25532f0caa23", "value": "1536:nUjArXYAVkWyjXJi68EnOzPIktb+10mhe4:UeXYhDLJ8EnAPIQeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130969, "uuid": "7cc4ff6c-38bf-40b5-aa5d-a0e9dd418877", "value": 55784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130969, "uuid": "88fc893b-2a56-47a8-8fa2-f019a640c725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130969, "uuid": "03b3a14d-0ad3-4f62-a354-9c001b60e883", "value": "botx.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec19608-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137748, "uuid": "def713d3-089f-4055-b31a-f2cb2e5546e1", "comment": "Malware payload", "value": "b9ee94299e506c3d079daaeca3f49dff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137748, "uuid": "345ee1b2-6675-4e10-81c2-a12fa25f80e2", "comment": "Malware payload", "value": "8581037c65e43323ae5228aab9ee03026d723fa9a2139e90032e179d4a4b3552", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137748, "uuid": "696c9002-d4bf-4242-8af0-7b3d84236d92", "comment": "Malware payload", "value": "68ec9f3d639ab4c047ecb33c360ed9d04cf08da5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137748, "uuid": "07921656-e760-44b0-b4bb-ce3c7751928a", "comment": "Malware payload", "value": "b1621ffa128bca2bf33686242d3f43932b2905b05ed45de6e64d92d936f843052526a8f16793d84cc207e9d5a104ecd1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137748, "uuid": "95f1a382-ae05-495c-a978-11312150c8c1", "value": "T1A51632D3B1D9605089683B7BDF2042CFF9054E8EFC4347D9B4A605E48BBD2217B61BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137748, "uuid": "cd4213a4-9ca6-460e-a08c-de7856510fe6", "value": "768:UUNXa/tGsNG4mFrQR4+epzf0Le+J9YQwK0n52Z+Z/4mPfTWpeznPsY3PEc1XYamp:ttatGNNb+JXErWpIXPEc1obz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137748, "uuid": "5c067eb5-9d08-44bb-ba73-518e065ef826", "value": 4269203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137748, "uuid": "37ac1b8b-6b5f-421c-88ca-aea8eac44f56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137748, "uuid": "afea016f-6b53-44c3-8ee0-c3385a50c0f5", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817b5826-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1761135632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135632, "uuid": "b862b243-0e53-4f4b-bbc7-dfdbfd228c9d", "comment": "Malware payload (Socks5Systemz)", "value": "d7150f8d8cbd8c0b7eadf852bf0c022b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135632, "uuid": "47bea9dc-f71a-4abb-bbd1-c66b0cf66b10", "comment": "Malware payload (Socks5Systemz)", "value": "86163e87b5ff397903974b03963c886c769a9e7df7d2677d51442ac88d27af32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135632, "uuid": "17082279-b471-4e58-bc9e-9d3fcc962380", "comment": "Malware payload (Socks5Systemz)", "value": "a6e47d0e7a35b13382977954c36024a00d4a023c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135632, "uuid": "4b32212a-b657-46cc-b702-cbff572c9e4e", "comment": "Malware payload (Socks5Systemz)", "value": "d8866c89b5d555c432259b0d35a1fd94465c187dec14189fc48dd94d753d5519efbd2274010948c2eb9fcb280d1f3437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135632, "uuid": "b792a6a1-1633-4719-8aa9-5afac1b4ef99", "value": "T14885330F62E450A2D5B113B058E155DBDAB2B9D2277663EF21D8C6FD0F226C16930F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135632, "uuid": "5f2b0483-e57f-43c5-acd9-55b656e75f62", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135632, "uuid": "d4d36949-6409-4704-b587-2d3f2b07de3a", "value": "49152:mgxDmqWuZI8yUmfFIIsGdOVBYz9X7kl3uM6BGaNAq+F:ntg8cFIA5XbJBlabF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135632, "uuid": "1ac71268-89a3-486a-915b-e03608da4740", "value": 1767856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135632, "uuid": "90a467bb-fcdb-4ba9-bea6-ed510424ac30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135632, "uuid": "fc134a42-c6db-4538-aaa0-40bd69e9d757", "value": "d7150f8d8cbd8c0b7eadf852bf0c022b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67559fcd-af09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761111537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111537, "uuid": "71b334a4-de08-4208-b259-6e325f98f77f", "comment": "Malware payload (Mirai)", "value": "76248eabd907da26c20786032a20867f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111537, "uuid": "87a888a4-b585-493e-b683-9e9c4c829a49", "comment": "Malware payload (Mirai)", "value": "8691394608b69730a8598f1374f19882bdeb98c63c110d8a621e80b653f3a4d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111537, "uuid": "11bba415-7484-48aa-baa1-cfc62ec3ed8b", "comment": "Malware payload (Mirai)", "value": "030a5687ad76a916bedbb16743446251970d3faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111537, "uuid": "5c70a3af-5f37-492c-bce7-7afcf8e04237", "comment": "Malware payload (Mirai)", "value": "2e50753b7736de776e2e5d6a5219d859fa6a933bb5158dcc8341a0bdab770c6532f3f152765996a49038b8c89892a35d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111537, "uuid": "7c78cc2e-aae6-45ec-a92e-8a6c34ca5c96", "value": "T17ED3B80E2D218F7EF768C63487F74E30A75923D523E1C685D2ACE9151E6438E681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111537, "uuid": "d3349e3b-a843-4297-b2be-eede1e9abb44", "value": "3072:up1ohmxH7PsERTPwKihfWDo1h8pzdQMAnFjoPInz2Qc:usmxH7RTonIDogCFg82Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111537, "uuid": "0b2a596f-ec28-4010-8f69-ea81bbd38653", "value": 142528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111537, "uuid": "1cfcc6b4-7049-4938-8805-360f9cfd6daf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111537, "uuid": "bee1e754-46ee-4e2d-9111-f2791a5570b0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ad27fb-afa0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176393, "uuid": "55a14aef-b5ff-492a-ad37-c6626b11c5e9", "comment": "Malware payload (Mirai)", "value": "013dbb0c12701be9895d3f2df1ab66ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176393, "uuid": "5cb7e532-6a9b-42b0-8a6d-6d0db7c062d7", "comment": "Malware payload (Mirai)", "value": "86dbcd1bcc64c2860a0d09c059425db0ea7deb573e397624cdad59271261a101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176393, "uuid": "02c958d5-12cd-4bcb-985c-93e6d5a16b6e", "comment": "Malware payload (Mirai)", "value": "6973755d9b5773b1cd4094854e72b71282311d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176393, "uuid": "fa814123-96bd-4c29-a237-e0264032d82d", "comment": "Malware payload (Mirai)", "value": "a00ecbab781e38a71405aca4833c8f24aa18445491d395dc7f4a9742ed64775fbdbe5c8662f0f715fca249f46c4073d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176393, "uuid": "f56a9712-754e-4a3b-87aa-bafa8a050a2f", "value": "T1A4C3F80ABF110FF7D86FCD3706A90B0625CC555B22A57B3A3634C928F54B65B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176393, "uuid": "d93bdcd3-b0e8-4d30-bbb4-962308d392ff", "value": "1536:ZPvZHT+DemrUy2+32vfjQJXpi7Oi97ZrnqAwg0tS547+ZSvmNei:ZXZHT+UFMJXy97M75vmNei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176393, "uuid": "15e8769f-d46d-446a-bbf3-9d795f61bbd4", "value": 122316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176393, "uuid": "115839a4-902f-4df7-841c-8526e832d0d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176393, "uuid": "a6671ed5-549a-42d7-a119-daf3fa2f93ab", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49135b3b-af7d-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1761161308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761161308, "uuid": "c5ec9293-ec5b-4858-8374-795cfa56d445", "comment": "Malware payload (DarkVisionRAT)", "value": "3dbfca3a5525212952a5763bfe136afd", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761161308, "uuid": "427a1596-5e60-48d6-bd78-805a8068981f", "comment": "Malware payload (DarkVisionRAT)", "value": "8718d69b82397c1ab31cdf2f2627a0df1197e4aa1ddc14abb886d3115403678d", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761161308, "uuid": "997e9a5b-5c0a-471e-a688-68af003c7cfc", "comment": "Malware payload (DarkVisionRAT)", "value": "b6c8e08a9748d6f91e85fa2aa1c1348e27acecbe", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761161308, "uuid": "73f57d5b-e127-4fc9-b164-d233da2dbc7b", "comment": "Malware payload (DarkVisionRAT)", "value": "937c993dea7d3e7f7eead7c6e9285da9c29ddef0d141de97cefc1fd0a6f0b5d13df7072c1c87a0d395a50300b6f1157f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761161308, "uuid": "9c681c4e-910b-4bda-9a06-889666589375", "value": "T11AA52300A68484FFD306CB759652F16E38242E7608804D5EE1B87EA97F76913AD73B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761161308, "uuid": "cf4211d9-6027-489c-af51-04c6ac46f404", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761161308, "uuid": "16c9dd73-a323-4eca-8fee-689ae6341609", "value": "49152:IMtvGoHbPNZ4Rz03tAXsKKFy6egbCRTdGi:dt+oHRqSdTBfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761161308, "uuid": "620e4b1e-0758-4cc3-9441-bad47e816972", "value": 2074096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761161308, "uuid": "16ce94a6-2543-43d4-a60a-d3e001297d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761161308, "uuid": "4ba61022-ea38-4323-adb7-7672bf7be659", "value": "SecuriteInfo.com.Win64.Evo-gen.54281853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be5e2ad-af49-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761138978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138978, "uuid": "dbcd8cb5-2ce0-49ab-8bee-b8fd8f592b9c", "comment": "Malware payload (PhantomStealer)", "value": "468c6861dfc6d707508ea3233b96dd92", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138978, "uuid": "fd9afb3b-1fec-4dad-aeb0-83a55b939d15", "comment": "Malware payload (PhantomStealer)", "value": "889c33102c5bbaf5a077ae32e934811a468ebaf32f1db003fc8e0a0393edad03", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138978, "uuid": "72970205-1a35-49df-99b4-7ce8595f4851", "comment": "Malware payload (PhantomStealer)", "value": "b719989533b31c6739740c7795076d0bb215149f", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138978, "uuid": "43d5e29f-7afc-4dc7-98c7-ca5f1346f8df", "comment": "Malware payload (PhantomStealer)", "value": "77a83d842a90cebd9cdcbc9be231543abb84ea963e6c070a6b4270a636251d25b88c45701d1d9584380eaa2ae0fdcce1", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138978, "uuid": "d95b92fa-b9f4-457c-bbc3-a75104a195ed", "value": "T151A2F17FDE15EBC427E64CCC03A69AB01EBFCCA454602636419933EAF43408D6E6D50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138978, "uuid": "0cbbbb57-b554-4287-b99c-ce6c90600569", "value": "384:RzozO7btcROnO7sMOgwgnoIr82SCfhbUx5nVOGrOCeWBWw7K+auENcvvQPf:RLbyN7tOZmoIReNLrxeWBWwOCjvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138978, "uuid": "b4515541-83d8-4d51-bf09-63ab73e4d422", "value": 22782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138978, "uuid": "8350fc43-b974-4132-b707-406238a44ca5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138978, "uuid": "7f004058-8d69-499f-9adf-bc6aac135dc2", "value": "New Order Request for quotation-TXZS-64003868996908.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a1f6d-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1761154409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154409, "uuid": "7260c894-fb6c-43cf-875c-54d028c20ac7", "comment": "Malware payload (DarkVisionRAT)", "value": "598aa93c46d206ce5d20949b4154ddf4", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154409, "uuid": "d29ccf7f-ea1d-42ad-a7d5-07eab24aadb0", "comment": "Malware payload (DarkVisionRAT)", "value": "89f30744e7c1f388d6e8ba5382224bdd973a9e5e9b7db5e9305118881e17b321", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154409, "uuid": "2edf55c8-9c6d-4da2-b4a4-04d3071fee89", "comment": "Malware payload (DarkVisionRAT)", "value": "d2830e770a2e14e6a80f2f171111ec182e64afd3", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154409, "uuid": "541d1686-70b3-4cf4-ae4a-258dc47c4982", "comment": "Malware payload (DarkVisionRAT)", "value": "9c36716cb60a8d2e7178d5643471657b65ce978df5f9817753ec8bf0235d0b330360da24231b3c866096c6e1039bed70", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154409, "uuid": "f11525d3-9106-48ec-b86c-919957917895", "value": "T1B2A522401680A0A7D7C4E7758681F69EBE612E7748B2BC9FF2583C3A6C720434E7765E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154409, "uuid": "5f0fb811-4e26-47bd-8a5e-3b67ccd04d9a", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154409, "uuid": "a77d46a1-4b21-435c-805e-73e7667a6f7e", "value": "24576:B+ka47zWKA74DKtgMg9QYzgvMYqXObf4PZ/3wE9bOHhS0wo0CZ2qsJMkoIB0ewVP:HsKK4DKtr07ObfSJgE9bS0CZR2zd0zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154409, "uuid": "78a303a6-f44f-4755-a3d4-d79f8fea37f9", "value": 2072560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154409, "uuid": "19c03129-d01e-44fd-9e49-4269adaf2064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154409, "uuid": "88ce9a68-fad2-4f97-9e89-9b06c4b810a9", "value": "SecuriteInfo.com.Win64.Evo-gen.52457333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b283272-af0a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761112026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112026, "uuid": "c64bcb2c-4183-4c6e-9139-1e1d8ba7d35d", "comment": "Malware payload", "value": "02dc219cf9645bac78d23e02d7c9a9cf", "object_relation": "md5", "Tag": [ { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112026, "uuid": "b23c6a4a-a0c8-4d38-8b8f-6c5c3d08fca9", "comment": "Malware payload", "value": "8db154b0eb19afdfd1b39a1985f53fe236a5d9d188de3d86b2ece52ac6d63ee2", "object_relation": "sha256", "Tag": [ { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112026, "uuid": "36c4a399-6908-49a3-9175-a2f88f842999", "comment": "Malware payload", "value": "b26367880095608092b1cde3cd56fc14f7a0f9fa", "object_relation": "sha1", "Tag": [ { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112026, "uuid": "ea9cb9b0-f4e6-448a-bafb-d55b6404134a", "comment": "Malware payload", "value": "53147758975450dd5575dd13b7e27b4467e3c1b388de4e94efeb9a73e56deee000bbaa817a647366fb4aba1b69f663c5", "object_relation": "sha3-384", "Tag": [ { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112026, "uuid": "3a5c0d1a-ef6c-42a1-bbeb-b71c6c94276e", "value": "T1282157F1715B70A4777A88725347CC739918340B096CFB15610F10B6AB0DFCDB56A2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112026, "uuid": "82031bcf-3658-407b-b649-bfcc6cd93f34", "value": "24:3Hr9T4Kl5ZcJc5rZJZt1fBtOGyaQkYJfkvN3TK5C4mB4xKU5uU+AVr4deOEuwHEr:bdHl5eKJNfrOaQZ6cslB4k0+jEmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112026, "uuid": "315ce13d-649e-4530-b26b-d7826d267257", "value": 1207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112026, "uuid": "870cbb27-8dbb-43d1-a4b1-5b472902805a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112026, "uuid": "68c8f43e-35c8-418b-a4e2-cf09dca4fa8f", "value": "screen.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0b6c6e-af83-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761163806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163806, "uuid": "07300936-2eaa-43f8-8206-cb49c950f0ae", "comment": "Malware payload (AsyncRAT)", "value": "885127590b2c7ec029e1c5aab5d0635a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163806, "uuid": "7f500b96-8cb4-4a0d-80be-866e9b8a78e2", "comment": "Malware payload (AsyncRAT)", "value": "8e1f62b87234e54baf7ca40bfd2a81a6ed53b5a009b15ce7e4cba7d54d39a3a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163806, "uuid": "3b114835-e3ee-46e1-916a-d6bf39c27160", "comment": "Malware payload (AsyncRAT)", "value": "a74100abab8962b0cdc97bedb9399180443c0f3e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761163806, "uuid": "a0e5b9db-8df7-4b3d-8b21-b753bddb52ad", "comment": "Malware payload (AsyncRAT)", "value": "1750a1855739d3994899be582c410743fb82296a03a9a4a148d6b3183289e0a37d3ec0af800f2f8a9f79533868887351", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163806, "uuid": "d87b81f6-e3d9-4655-ae6a-193d56fc5621", "value": "T1E453F7013BE98029F3BE8F7469F7628546F9F5AB2D12C55D1CC550CE0932B829A41BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163806, "uuid": "9e7cb8f9-6e56-4ac5-b8c6-811fe70dd309", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163806, "uuid": "cbef41bf-17c6-4142-a629-e9c50ed2979f", "value": "1536:FmIm86tX2kNff4sKu+UYFDGXw5bfAPGBKB4ic/drQTGZx:Fm986tmkN7Ku+UYFDGXw5bfKBLc/dGix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761163806, "uuid": "bac92dee-e693-4d84-9932-fb6a556ccdd5", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761163806, "uuid": "35f9af84-2d56-4dd1-a8a4-1b412cd82bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761163806, "uuid": "6e69cc0c-ead8-4cae-b65d-5e35b9a762cb", "value": "8e1f62b87234e54baf7ca40bfd2a81a6ed53b5a009b15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e56b048-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150498, "uuid": "8e2e1446-9142-4d91-b883-ffbd521f23cd", "comment": "Malware payload (Rhadamanthys)", "value": "02636e453aa7aa1f34cb2ddb00e73edc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150498, "uuid": "88c829a0-b697-4f9d-9067-59785ad90fb8", "comment": "Malware payload (Rhadamanthys)", "value": "8f3660af6c061958387ea8c3d9675ef755e15ec700491ef2723a83080857d0a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150498, "uuid": "f201fbf0-f190-4d49-ba51-c06b2839699f", "comment": "Malware payload (Rhadamanthys)", "value": "4199dd5980874610370e32a19c14fcac479cd803", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150498, "uuid": "8dd78a3d-a414-4eaa-9ad5-b74cf8214873", "comment": "Malware payload (Rhadamanthys)", "value": "56b72d56efb836d4e7b3cf1a8be777eb16dd14014223f6a913223d110e8452d8f970089af8507b20e8bd747ad1188c15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150498, "uuid": "6d14164d-04e1-4fdb-b80b-8743c4156dca", "value": "T1ADA329806A37DCF643C573642D47449494639842BD868205D86BFBB2B10FFA728EE7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150498, "uuid": "16af7745-94c8-4aec-924a-86535459f6a7", "value": "3072:GDB7b0x557cRnF0tS8NYCnGgJO9PPp7JMMxEMQPzpo+7179Ba/CoJuz/a11riXYI:0G557cRnF0tS8NYCnGgJO9PPp7JMMxEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150498, "uuid": "c4e768cc-f8e1-4eea-a1fe-c032e429fcb5", "value": 100768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150498, "uuid": "60160377-9e54-46cf-bffe-0bece0ae0b2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150498, "uuid": "1dea2c93-ab55-455d-88fc-1a7c1aae767e", "value": "invoice-1637482117.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ff30fd-af66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761151399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151399, "uuid": "b43fe6ff-7033-448c-be0d-9c88240e2930", "comment": "Malware payload (Mirai)", "value": "34e6795251bb15a79620aa95ff5cb96a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151399, "uuid": "908931f6-9598-4d2b-9665-0189966026aa", "comment": "Malware payload (Mirai)", "value": "904a2c2e6a4535a1cfa71b05f7d58a05d2f150623470aeb5ff533c9f01edafa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151399, "uuid": "e6d7018e-7c75-4197-b352-76621cb89bd1", "comment": "Malware payload (Mirai)", "value": "65c493bf31f48bfa650eee07d8ce0fd04e31c6bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151399, "uuid": "4f5eefdd-093c-4c51-b599-e7391d4b04f2", "comment": "Malware payload (Mirai)", "value": "24a28409d29bac667c700006a5a3670771b09ef2deeba05ef1e38eee1b6c043fe853bdb073e4b2c0bba8f865481f7372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151399, "uuid": "0b37b515-2500-485f-9bf7-9ba225acdb6d", "value": "T17AD30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151399, "uuid": "adff0c41-8f25-4b01-8382-c6edcc54f201", "value": "1536:VHQeHIjFlGz/r56Qp7/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5A:VHQeF6Q59FcT4YZMDFYA9gAplNib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761151399, "uuid": "db15c735-17a9-4099-a0be-96cf2f29e234", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761151399, "uuid": "9c476c54-c214-4fdf-97de-6e3081934f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151399, "uuid": "819808c5-816b-46df-b92d-875a079d4181", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0989d18-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761131067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131067, "uuid": "6bd4d908-c922-434c-b3c4-f1c83a5a72eb", "comment": "Malware payload", "value": "e3ec74486c1f7ca56eea0c2988630d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131067, "uuid": "2cc69a44-cf53-4f22-b480-5c9bbc7c2269", "comment": "Malware payload", "value": "912b290e0525ae4ed780f13286ecd6c847d92e921ffe1cd7cbcc479475eee942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131067, "uuid": "912aea6b-86f3-4889-8d60-858313c99b1f", "comment": "Malware payload", "value": "05ec64b6dd673c46fab4506af607aa4edc9eeb80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131067, "uuid": "cf7da191-aa6f-47ba-9822-ae273a6b2489", "comment": "Malware payload", "value": "5e2468949f712b9198b7f4d61e0318912a3fd6f9adb564d006d9278d6d5eac8508380ab63a7b6e5c23651d811a5cf8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131067, "uuid": "60c7a099-b366-403e-b2bd-f26adbd5b5a9", "value": "T1DE15026C2B5ACD02D9815BB14972E3B8566C8DAAFE14C2038BFD7DDB3A35A453C19343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131067, "uuid": "1423c75b-2a88-4fec-a29b-29df4ae01a7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131067, "uuid": "7d80e4ae-04f1-4a5a-b28a-807e7c78c5c1", "value": "12288:bNYHkiQ/mq2x0fRa5DUhxkau4rjjUIaeOnIXHLiNj6Dabup1G3X3uO:hYEiQ/GoRaakHIMnIXHabL3X3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131067, "uuid": "351ddd28-6c00-4723-9aa8-7803bc7d943f", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131067, "uuid": "eef696f7-aa66-4e08-82fc-36348323bd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131067, "uuid": "a88966f7-9826-47f6-8f79-660310baba43", "value": "QUOTATION#03308MV221025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca7e286-af28-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761124726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124726, "uuid": "959c2d99-e857-4b6a-99f9-746f2c153d86", "comment": "Malware payload (Mirai)", "value": "100d4f05ad791c91f0273cc0156860df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124726, "uuid": "cabfff69-eee7-4a61-b999-fac2b76c0c37", "comment": "Malware payload (Mirai)", "value": "91fed654ad0893b77f0acc0d664d134ff462112430f22e93e8aedd39b4381d1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124726, "uuid": "d682e19d-9b0b-4378-ac56-942c9cb31a4e", "comment": "Malware payload (Mirai)", "value": "8589f113b93551c4d1edd14baaeada84db04d22a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761124726, "uuid": "611aeac3-c58b-4185-8aad-35fd07ff62ea", "comment": "Malware payload (Mirai)", "value": "7cc30d487ef42aef473f94e3b06968e9521dd29560e5bd65bd91f017dfb2759420c6dd0902cb011a2bd18b66537bfc19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124726, "uuid": "a83ec380-1f07-440c-88b3-8d29122162da", "value": "T1F9D30945F8404B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124726, "uuid": "23c814f6-6df3-434b-9055-4f89383d47dc", "value": "1536:QKdzElm18uZJjb0A+Fa8eAZHk4VB7fzTTPXRbg4Sv+6eqZ/x20lShwyw6RNPMTWF:QKpnIxU8e947LfXRbzSrtBxTphKPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761124726, "uuid": "403d43b7-0abf-4fe0-995c-24e427270742", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761124726, "uuid": "15532ade-e4d7-4799-8600-e3f26bc1b8f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761124726, "uuid": "019edb46-32b0-4d2d-9357-62744b3259f3", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4160b34f-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150557, "uuid": "ba15ea91-983f-447b-bd83-9f4e31185b52", "comment": "Malware payload (Rhadamanthys)", "value": "ea5a6354dbfe795fa07a9598815a14c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150557, "uuid": "763fa91b-e3c0-4a2f-bdfe-d68db05572eb", "comment": "Malware payload (Rhadamanthys)", "value": "930f8f89f427620e078e3ca7494272c9ac807b2da8f59055bd24b79f98b31a04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150557, "uuid": "268037aa-357e-4b9c-babf-bcfc61ebfb61", "comment": "Malware payload (Rhadamanthys)", "value": "516f68377137e22ad753ee71fab96bae663ee08d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150557, "uuid": "b16ccc50-79e7-45fb-9a92-f9f221122a46", "comment": "Malware payload (Rhadamanthys)", "value": "1ad2ce9e9afe332a94d23d1748ab0b40e163416311211987eafb8b194258c24e047be07b29abd8fedec72fff76aa82bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150557, "uuid": "c0b1a5ab-fe7a-4524-adcb-c758b064d83d", "value": "T12EA3EA6E2F4276F20546363B2ED45C6C844D8AC69E97C846F14FBF479D393382EA86C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150557, "uuid": "918dc341-a527-414f-bbaf-be3fb9406ddb", "value": "768:GDhd0i7J4sYKgY/CMNfWdHef9u0DrDrTsO9syYlXO/5G3h8XXWzt10O1pGgTveCC:GDB7eKg203rnr993ZmAmRo6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150557, "uuid": "d0e2503f-9bed-4cd3-aef1-95ba627a3614", "value": 102757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150557, "uuid": "8ddf5fda-c08f-4e41-8124-8d180ed9a8b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150557, "uuid": "5c1f1e65-4f29-45ae-b17c-98e48511d668", "value": "invoice-1637482117.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec2cc06-af39-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761132058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132058, "uuid": "708650fe-4ca1-4b47-a256-f7bd7bc2b7bc", "comment": "Malware payload (AgentTesla)", "value": "b9d9341cebc3b392b96e923b1c5206fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132058, "uuid": "397e9dbe-2422-4a69-b547-e03fcec152b6", "comment": "Malware payload (AgentTesla)", "value": "938d90bf1bb3fcb3c7352990f0c05603b0208bee21b6e3d02b5f0cab97f7f35d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132058, "uuid": "acd8c1f0-e785-4c5a-ba4f-58bc3f47d526", "comment": "Malware payload (AgentTesla)", "value": "88b3a04ef39447f966ca2a43cbd3cc243c9dbf1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132058, "uuid": "0bfb5d2b-afd7-4769-90d5-0b7b2a18ea04", "comment": "Malware payload (AgentTesla)", "value": "d4851107c822811c1b83a71dc4670b8364741e64df4548260f5e82fa8dc3a58010bd940c59e3c8c1ac4876000909e928", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132058, "uuid": "830462aa-8815-4ac1-ab4e-869011acf107", "value": "T14935BF0273919062FFAB95334F5AF2115BBC7A260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132058, "uuid": "50a147ad-7b27-428e-9d90-715728796c75", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132058, "uuid": "509c3717-87fe-46ed-9dad-3253c93d05ca", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdab9c4b9HoUX7z6gf/d:0PVt/LZeJbInQRabe4b76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761132058, "uuid": "335ed9b4-e010-4124-8ee5-425dfe2107c8", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761132058, "uuid": "87828444-dfde-4598-99d5-7cb411475e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132058, "uuid": "1c04a440-e60e-416e-953f-97545029281a", "value": "dj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfdcf7c-af5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761147008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147008, "uuid": "cda22ef7-e68b-41bc-bdac-972e10523717", "comment": "Malware payload (XWorm)", "value": "5f367a3bb57745d7b9973cb96084c575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147008, "uuid": "54d00ece-409b-46e9-93eb-20d8aa867161", "comment": "Malware payload (XWorm)", "value": "93bf2ff2df8cc3647b056d883a94e6fefa8666ac0d853b62e229781eee31b313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147008, "uuid": "850f1691-b0b9-41b3-989a-eb9223dc2ae3", "comment": "Malware payload (XWorm)", "value": "75b88d2c7bc320f781c4d8d41a930b54a4df3650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147008, "uuid": "a2f0a8ae-0c70-4e32-9c44-28c47f73b18c", "comment": "Malware payload (XWorm)", "value": "33e311ea891ac898025d05ebb81a46d16631159f3a954e1ca4eb610ffe0128b6dc4a1285fe6d10a1839a7bf32327f14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147008, "uuid": "891c3b8b-a712-4bf9-aca0-757a568d3408", "value": "T13384610CB63AEC87E45E9F723E92E375847E2C038E619986B644FFFE5A3550193C8911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147008, "uuid": "7dfe55a9-7282-4965-b3b7-095bb40cf1f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147008, "uuid": "6bd64654-b15f-4f2b-91a9-974a5e65772d", "value": "768:vgZA/699tIN1wFs9jYOjhbbKnnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZr:vg46fumFs9jYOjtPkccckcccccG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761147008, "uuid": "77f8ee8b-fa95-4232-963b-66d9bae09e3b", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761147008, "uuid": "16d8f622-c981-4e2e-9124-f8a4b692ca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147008, "uuid": "0b3b84fb-345a-433d-bcb3-d8bbafc348f7", "value": "93bf2ff2df8cc3647b056d883a94e6fefa8666ac0d853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a0e4f8-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150423, "uuid": "01b61dc2-2bfb-44f5-afb6-131cbf1704cc", "comment": "Malware payload (Rhadamanthys)", "value": "48884f7ee74b0f32a8ba312ff02b6157", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150423, "uuid": "34b7bb2e-ce91-44ae-ac97-16ede2993c66", "comment": "Malware payload (Rhadamanthys)", "value": "93c466bbb7907277f0f59b4ca95633df16991532632be2303916ae4508367b87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150423, "uuid": "7cc5a593-37bd-4a50-8ce9-e1eba08ceff7", "comment": "Malware payload (Rhadamanthys)", "value": "1e922ae0f40f99978313dc3fa6fcb1de0fa15f2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150423, "uuid": "6a318277-1ae4-4192-b9fc-0f4415045c72", "comment": "Malware payload (Rhadamanthys)", "value": "320cee8344a422cbd5745b00e28977cc308e327d1f8cdca0326fe0602d02d9dec23aba36600a2c3b0c447db29a966b74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150423, "uuid": "c1659928-1aa8-4e43-8c0a-eb29771015f2", "value": "T19FA3FA682EB34F940EE09554EF5C04F28DB7DD828A14F0A18A79777224D8E593B9B3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150423, "uuid": "75813e18-3023-4d7b-9e3f-03e7a9933c5f", "value": "1536:GDB7eKg20ykirjr+uFuFnRZWwA9pmY6p6BkQWJ+aY:GDB7b0MffWY6p6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150423, "uuid": "bb4c8f7d-10a9-43ef-a9e8-876083d90cae", "value": 102708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150423, "uuid": "bff4b90a-8285-4a6e-b96d-1a769bde313f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150423, "uuid": "c3b81c08-78e7-492f-badf-9f2f6bfa8169", "value": "invoice-1637482117.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaa29c2-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150439, "uuid": "d3136764-3a18-4ad5-a1a3-0bb804ec8184", "comment": "Malware payload (Rhadamanthys)", "value": "da6e013a377ca7de4f76e5eb1def1440", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150439, "uuid": "f7727143-63e7-4aff-93cb-3db11e2a4f3d", "comment": "Malware payload (Rhadamanthys)", "value": "954c9c7eee0d10758a5747596e31cdc47598bf82779595a0f8a418b84e3d19b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150439, "uuid": "fa5f4286-c472-496b-a7e1-0e65829c7659", "comment": "Malware payload (Rhadamanthys)", "value": "1ce043dd6535e8a10786e02fcf8a1f73134a1b17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150439, "uuid": "889eb69c-1b27-4a22-b6bd-67d631e699b4", "comment": "Malware payload (Rhadamanthys)", "value": "67394c37cb9c03ca95e1d182f7a59b5d593969aa179c57325423ea12cb876c442ba2fdea4d8b320ee77ceae8e2398f99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150439, "uuid": "f7565f5f-bd3a-472d-aa7d-8237aba4a47b", "value": "T1EFA319841C538C9104F823F71F886CE3DCA275C121A1D2A9AD3EFA4A9063755BD6EDB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150439, "uuid": "2c719d7d-524c-4dff-b0fd-777654c83761", "value": "768:GDhd0i7J4sYKgY/CMNfWd84gNUkBH0hXFv+UBg4gw05UuGcZYIF9LzvWNQZwPg1B:GDB7eKg208rnrC8GTQAvgs6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150439, "uuid": "46942ee9-15af-4f28-a89d-4cc14e9b62d8", "value": 105307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150439, "uuid": "511fe53b-efe2-4183-80a5-a0c2e2503703", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150439, "uuid": "e67fd3e0-37ed-4703-8deb-8e67de732123", "value": "invoice-1637482117.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b875246a-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (OrcusRAT)", "timestamp": 1761113391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113391, "uuid": "edaba66c-aba0-430a-b157-820cbbed9e1b", "comment": "Malware payload (OrcusRAT)", "value": "1e6f477a05d36c31f74c080d8ab06a65", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113391, "uuid": "d3a9d471-c33a-4322-b94d-fbb8e74c1ca1", "comment": "Malware payload (OrcusRAT)", "value": "95ce2e3ed77c89dd3395962f43d7897ca91471cd184b7b0a5e935077ade5c21f", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113391, "uuid": "690311b5-91f7-4ce0-a763-58ac9f26d16a", "comment": "Malware payload (OrcusRAT)", "value": "fb2aa7bfca1c5566d1fd251cce1e912715eccbca", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113391, "uuid": "9a6e75ec-36d0-4412-8ac9-95d815a494c2", "comment": "Malware payload (OrcusRAT)", "value": "c6c0e7ec525e8b6ace7ec568d615c95b08c3a00b8dcdbf20abe38f8f7eae379ceeb908c13fd04696f365995aa01b76b4", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113391, "uuid": "1ea9addd-cbd3-4ced-9952-103d08d77d1b", "value": "T126163341E09299ACEB243B7282E6D4B00159FF934D42ACD83ED55D1FFBA2222CDDD499", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113391, "uuid": "048fd85c-f045-485b-8e0c-0dfaf1b73183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113391, "uuid": "6ba50a5b-12b2-4d18-b7dd-ae49fe59d039", "value": "98304:xtmEuxD38yRpdy6rMQaAJDX2eZHYz+D073s6yGobjQzWL99eI:xgFh3LRpdLrMM3VYzLuXJ9eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113391, "uuid": "4a354a72-781f-45b0-b045-6451ff00e8ea", "value": 4058624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113391, "uuid": "a15f1ca3-9474-4e98-b9b1-44cc76abc8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113391, "uuid": "dc6f6c70-67cb-49dc-8881-7ef3c706d30d", "value": "95ce2e3ed77c89dd3395962f43d7897ca91471cd184b7b0a5e935077ade5c21f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1237e1d4-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150478, "uuid": "e2264fd3-3b42-4986-9ae3-40c4bd3c9fea", "comment": "Malware payload (Rhadamanthys)", "value": "0cb7421a7104bce97cd11e2b351387a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150478, "uuid": "e1ec7eff-8a29-437e-a41e-7fea6c063402", "comment": "Malware payload (Rhadamanthys)", "value": "9607c7f88fc5a5b3aee469a7c39b5b7b4e5d6b073f1aa5747ea378b099d87359", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150478, "uuid": "7d037d68-ba14-4dc0-9868-d145b6ea3ca8", "comment": "Malware payload (Rhadamanthys)", "value": "15dade492a1e4200640b8c8a3dc8300a4b2ab085", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150478, "uuid": "1d14faaa-33d1-4093-84b2-cb13e562ea15", "comment": "Malware payload (Rhadamanthys)", "value": "c02722bfd4055dc2cc5bda0b916fb750c805f7520a598c6b3dc3e1753a2363ca2c2eba167e9e32e024406a84c7368faf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150478, "uuid": "37d698f5-43e9-4c44-b39d-fb2ee9833d78", "value": "T182A3EACF9CABEED360FE9ABC3C1010D785045EC62385A2499B287753044B79BA69DDC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150478, "uuid": "bfa8dac2-cb52-4f54-be96-a0dc8b4c9fbe", "value": "1536:GDB7eKg20wnTnRrTrU45nRLnrCnRnJndAhn8nHnXNz6BkQWJ+aY:GDB7b06vZLMNz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150478, "uuid": "e644b2fa-b983-4b11-b7a5-caa33c4d2c01", "value": 103967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150478, "uuid": "e970fc39-c4e2-4c08-b358-f774aad5f256", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150478, "uuid": "dd3c96cb-44ed-47b2-af02-2ccef0540396", "value": "invoice-1637482117.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c72607a-af0e-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761113532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113532, "uuid": "55ed7748-e85e-48d8-b368-4dcbe085350c", "comment": "Malware payload (XWorm)", "value": "fba8e6ebfd37f3c164bf606885a1cef7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113532, "uuid": "9ff136d3-d387-4ff2-ae79-1183c73d18ce", "comment": "Malware payload (XWorm)", "value": "97dfa193e7571e7bb543bb89cdd57b5f660e099c543e296985c2aeee7c152c26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113532, "uuid": "924e7e1d-2682-4c10-bda1-cc86fafc9cc7", "comment": "Malware payload (XWorm)", "value": "26b7f6219682f93b3d77bdd80e014827b9971bc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113532, "uuid": "517167f0-4615-4337-b79e-9f7d6cea8ae8", "comment": "Malware payload (XWorm)", "value": "bb0abbe36bcb032685a15fe55f3b1f502ed8d4ec24519f14bba8223871a9a2da52a1c765b7099ad89c98bc9dc6a3c05d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113532, "uuid": "ba2a1b4f-280f-4ee5-9874-9bacffef310a", "value": "T148066205FAF29D89F7A1DE994A07BFC5D5141BE725080CA274BCACDC6FBA1B0619013E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113532, "uuid": "81aa90ba-55ec-45cb-9384-0a9372c38794", "value": "24576:RrgHCaLALbnrgHCaLALbZOPoLHKG2pKpE2O1hFHHX7AcIZ+rgHCaLALbrrgHCaLI:T1MPoLqG2pKpE2O1jHHLxh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113532, "uuid": "d09e60bd-f90f-4c47-8ad3-4ed219fade37", "value": 3717773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113532, "uuid": "880b8f02-37d2-49d2-a97d-e1a98055767c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113532, "uuid": "bf9079e4-500e-4d5a-8f95-f5c562cd636f", "value": "PurchaseOrder_25005092.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d791205-af68-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761152430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152430, "uuid": "5977d4fc-5fdd-47a2-9f23-17d07d5ea262", "comment": "Malware payload (Mirai)", "value": "cea4cd498e318f4ce9d35528990f4be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152430, "uuid": "c07b2c5c-b75c-49f7-a9e7-4b4f0e5023e3", "comment": "Malware payload (Mirai)", "value": "9857e1ddf1a9729966968fa5fc70c74ebccbfbb1e7cbb2927dba21fc30894f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152430, "uuid": "88a005ca-5d62-4bb8-8959-9002add33517", "comment": "Malware payload (Mirai)", "value": "1f6ffce9839af020ac1d07638dae973251aa5d9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761152430, "uuid": "103c91b2-037d-455e-98e5-16c1600dbacb", "comment": "Malware payload (Mirai)", "value": "3bd4d3a644474dde04a3d7ea0991bf52415d0d5af5814a459b179c10db2442d3aa9aab2f408a9aa95325dea7ff168ae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152430, "uuid": "18c5085e-0e39-41e3-ab42-aa7baf4941c5", "value": "T115D33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152430, "uuid": "bf4fa3b4-b78a-47c7-ab99-83c79d23da4d", "value": "3072:tGtwnNiaOnUTkFiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTuuLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761152430, "uuid": "8348249c-3140-4fe8-bc65-a5923504aa11", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761152430, "uuid": "7972b9df-ad7a-4e90-bfbd-d95ac62802c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761152430, "uuid": "2974b6e0-ecfb-499e-a38c-316d495739b4", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef14c550-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135816, "uuid": "6353f0b6-2f1d-4399-8c3c-7b18ebdd47ef", "comment": "Malware payload", "value": "309dd2d679f43c593fff49faac1fbf93", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135816, "uuid": "b81146e8-944e-46a3-aabe-5ce146373e2f", "comment": "Malware payload", "value": "98e08998a94cd6cf38a9995b3b114910600e0ee29000e9392ebca52d40665ded", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135816, "uuid": "844e2814-f0d6-408a-a817-2a13a68b0e72", "comment": "Malware payload", "value": "e7514e5589acbff7912ed4c7ab799febf9105f15", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135816, "uuid": "417c78bb-6ba7-44d9-8959-60bf35a8c77d", "comment": "Malware payload", "value": "c22df3a0c72ad9b292f8c8fb0ab39eda14e4a5d7ef0d72ae114cb6ac4b70f9bd724286940dc8dab5fbb6a45e47163111", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135816, "uuid": "4d504abe-96a3-45c7-9ab1-a03cff6299a0", "value": "T188352324FDE58F1EF917243848CAC482262E9D74379BA29377467F5E3238A34C58392D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135816, "uuid": "43b415dc-6445-4f04-92e8-0b295138d674", "value": "24576:fviUwv6D9ARMCHGibq/RuQF1TlnbsRCHc:fviUwv6DiRRq5j1TBuYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135816, "uuid": "0cc81a93-6d33-406d-821f-0ff056c3f6d3", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135816, "uuid": "456ec6eb-5b81-412e-b32c-f6f3959abe23", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135816, "uuid": "2824ad91-f77d-4b29-b985-86ee384ea80d", "value": "Request.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9049730e-af5f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761148542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148542, "uuid": "d66e4ef7-17a8-4170-916e-98d1e275d3d0", "comment": "Malware payload", "value": "26100a077b4661a0b29fccd58a7f2f9d", "object_relation": "md5", "Tag": [ { "name": "185-93-89-62", "colour": "#5FF9F2", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148542, "uuid": "29693b37-5fe7-46ab-93f4-a0d2770b9e0c", "comment": "Malware payload", "value": "9a4b14a7ff3cc6443a2b9e3a95a2259295d5809b81cd5829d12fa87d4e60ed71", "object_relation": "sha256", "Tag": [ { "name": "185-93-89-62", "colour": "#5FF9F2", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148542, "uuid": "a4d98ce0-8ffc-44ec-83d6-368f011d4be5", "comment": "Malware payload", "value": "8ee6ad37c6b245f42cbf0f2795f7ee2a5e13cfa1", "object_relation": "sha1", "Tag": [ { "name": "185-93-89-62", "colour": "#5FF9F2", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148542, "uuid": "e5a18a70-9993-493b-b613-6413ffe97599", "comment": "Malware payload", "value": "5f90deeab120839198442fc113d6f849a98969bb363b59c55721b4d771539ee699e25a244717121e8caccd679e5d7088", "object_relation": "sha3-384", "Tag": [ { "name": "185-93-89-62", "colour": "#5FF9F2", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "Odyssey", "colour": "#EDEF7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148542, "uuid": "e9c7703f-781d-4364-8491-57f9fedb20a2", "value": "T16A05237F010E2EB5EC8D1C7498701F190EBE9ACFABB99156B5524E783AC3C5227B0349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148542, "uuid": "4515e3cf-4e9a-4820-b69e-03105f8f3747", "value": "12288:rbmSyq/VJ+pBwDLohZHivB9U3oPOYakaZkYNWRUMG7pgTMdykhcFCqNwMgKciLC1:+xq/VewXCZ8TUZYax99gUyq0lgauT+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761148542, "uuid": "a0178b85-dca5-4c04-93f7-aaed57458a49", "value": 804019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761148542, "uuid": "5555f1b8-9d61-435f-bede-7a3d3f86234c", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148542, "uuid": "bb5d2a8c-77d4-47bd-a31c-b961d1a1e756", "value": "ATTActiveArmor.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150ae490-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150483, "uuid": "bc384cbe-1cec-405c-8d42-723a7c5f74c1", "comment": "Malware payload (Rhadamanthys)", "value": "f91da7a442e4a9f2697e4aee1f60e91c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150483, "uuid": "204f11c5-ed60-4cd0-bd17-4e477b39664c", "comment": "Malware payload (Rhadamanthys)", "value": "9b21cb6035d188e2e4ea28a8012e210ed98ea7f8c949e601592d77d3658c4a2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150483, "uuid": "0bca785c-25ce-491e-8b10-0c833f31d851", "comment": "Malware payload (Rhadamanthys)", "value": "3c9d99251f8a23a84d96188563c37aa2a5de2565", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150483, "uuid": "fe2be0b8-b837-4940-a229-81c05f282aea", "comment": "Malware payload (Rhadamanthys)", "value": "5cc5d1fe3a87d6a989b8b1ec0e12d65a835d8598d3bf4d781136a066e13aea5671e9093f0bacb7c03abe39f61fa9a0f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150483, "uuid": "03a38bb6-f610-4912-ae0a-3e846c007186", "value": "T1BCA3187928AAEF245118512C0EFF7830C5886C7A37953691A153F2395ECDE242F78BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150483, "uuid": "375aef54-bea0-43a0-8199-5f51874fdeda", "value": "1536:GDB7eKg203PIrKrixUPY/ye0NActmTFNU6BkQWJ+aY:GDB7b0yoiX3F26BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150483, "uuid": "c88f48d4-8888-4667-8c7d-364d87f4e677", "value": 107342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150483, "uuid": "120939b0-cd77-43d3-a3fc-3be6e9198aa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150483, "uuid": "2269e65b-7a57-4ec8-8bdf-2d37e25b9658", "value": "invoice-1637482117.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed6848f-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761114368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114368, "uuid": "824a5454-e790-41e0-ac3b-e25c082c2d72", "comment": "Malware payload (Rhadamanthys)", "value": "8da9c98144b64bfb7250bf768e8062ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114368, "uuid": "088690a7-18ab-463f-ac16-f255026239ac", "comment": "Malware payload (Rhadamanthys)", "value": "9d1026657594e588eee1b713f4280c20f5f8fef0c837b03231406c623abbb3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114368, "uuid": "a1b092a8-d161-41ee-96de-4fdd490f8ab8", "comment": "Malware payload (Rhadamanthys)", "value": "5a358c01afae877f0787f7c73502d9f4cbc95ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114368, "uuid": "529866ea-f385-42dd-ae14-ab5a8079461a", "comment": "Malware payload (Rhadamanthys)", "value": "4b4200d2aef121eb6673ea90ca4df8f9628ada19c254c9d0ce6b1701279b7292e4e066f12b9cc2027cb252fda73ccc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114368, "uuid": "ff66ccad-337d-4089-b969-140eb5cecd8e", "value": "T1DCC4AD4E11790C27C1F916FB88B65346856F60A05182457FE7DDDCABCE0E2A36BE072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114368, "uuid": "a1e629aa-32e3-45bb-a937-1d15ef37f27a", "value": "c84f18c64457a2f585ead47ad12eb0c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114368, "uuid": "8931bb89-bcac-4797-a3b5-490e1305af55", "value": "12288:100laqWR+JP4N7m4sC+vfCIEwSA9Pzi+cofn6pLp1:HQN7xsC+nvDSA9Pfxfno1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114368, "uuid": "2112f363-e892-44ff-b426-c3d79719f132", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114368, "uuid": "2f5592f5-5292-4cb9-811a-8982c259b1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114368, "uuid": "0f3d0a18-06a4-4744-af63-dda66ecc5989", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.41909.9441.830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7121f932-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150637, "uuid": "55e29d53-3ed7-44eb-9304-8dc2441617e0", "comment": "Malware payload (Rhadamanthys)", "value": "cfd4969718dd0ed4618a80649d676e73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150637, "uuid": "b65a8970-2542-41d4-b97b-696a9730fc4f", "comment": "Malware payload (Rhadamanthys)", "value": "9e1a0ff9659ca98c5a1910fb3ed85ad087449c37ca71ab1580add2396ce09768", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150637, "uuid": "2483a550-7fd2-4a8a-b2c9-f206ff433d18", "comment": "Malware payload (Rhadamanthys)", "value": "bfcdd858254b70c266e13298bad16f41ba115ec3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150637, "uuid": "ef494ba3-74a6-4552-9516-2302547985e5", "comment": "Malware payload (Rhadamanthys)", "value": "f1a30875425607c11522a4a55f75cc8da73cd1e3150a627183f09dff342673ab046d6f2c7fde702c57da318350b61297", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150637, "uuid": "b44b43b8-4740-4102-8c56-ddd9daa62ad5", "value": "T1EFA3090C4C7A7DF0420972863E6959B5DC8698866C96803BAD2FF73940E1EF63B11ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150637, "uuid": "4b286a01-9223-4da7-bc1c-67f26e7008f5", "value": "1536:GDB7eKg20yZvfyUfIof4kf1fdf11zEArufDNZkf1RGDYft7Rs6j7tYnXYDORxOKP:GDB7b0mLdJxOb962r0wg6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150637, "uuid": "e6a8f5f8-c37b-4bd0-827d-fac2fb0ceb56", "value": 102025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150637, "uuid": "4eb05403-a74a-4acc-9055-2e4bd93175b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150637, "uuid": "575e491c-a30c-4252-a7ec-5a429b12ff35", "value": "invoice-1637482117.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8b7e96-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150682, "uuid": "a0409a94-ce0b-4b8b-af78-d0276806820f", "comment": "Malware payload (Rhadamanthys)", "value": "f7c96de2605825b44d518b46f0b1a66a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150682, "uuid": "db674356-00cc-4bf4-9da9-ae70b7475fc4", "comment": "Malware payload (Rhadamanthys)", "value": "9e45fd04c07ce49dfc338a00b9254bf4e5bff656f2128f4231d171042e8c81d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150682, "uuid": "61b0d77a-664b-4b79-8c84-9c0099318d5a", "comment": "Malware payload (Rhadamanthys)", "value": "10fd159d77cb69f8ea792d04ec68e87a9d1b03fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150682, "uuid": "76f25033-8a00-4780-8330-0606ecd2323f", "comment": "Malware payload (Rhadamanthys)", "value": "315b8cbd1baac58fc58e9eeafa56e5fe9f121635a7098dc0fa1d933c85bd83fdbee7a1ad3d01dc315a92a654e44e5ffe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150682, "uuid": "fe5d7018-f38a-4c74-8a95-8528b0092da5", "value": "T1A6A3E9E614E3E966019C74AF0B1675B1C0FD406CE44E92299C0BBAB19CECB11D96FBC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150682, "uuid": "b9256fcf-0df7-4eb2-bb72-4404e13f429c", "value": "1536:GDB7eKg20FdpdLdndFdjdNdBdQdLdMdWdAdidLd4d0dhdWd/dNdBdBd8dIdVdXdN:GDB7b0vrlwkST6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150682, "uuid": "30d7988d-d344-42fb-b0a4-16d96a007310", "value": 105943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150682, "uuid": "406d93cd-a9ac-4bbd-bd1a-a080dd567797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150682, "uuid": "326d21dd-f498-4f27-82b6-1f3f1e9f4b4f", "value": "invoice-1637482117.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1857b0a3-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150488, "uuid": "ea63b60e-eed0-4910-848a-de9f85821a7f", "comment": "Malware payload (Rhadamanthys)", "value": "96026f07b6965e91a5c8ee9372ef2187", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150488, "uuid": "4c2433c1-028f-4a06-b6db-bb6987553398", "comment": "Malware payload (Rhadamanthys)", "value": "9ee0613b79c61d4e25024298a5cb2c5dd4def776d5219916818ecd27da3e1b80", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150488, "uuid": "39e1b0b0-a3cc-4825-8ebd-d2558a8ad3fd", "comment": "Malware payload (Rhadamanthys)", "value": "f4815b0d265c3d2f2e77ee329e4f038f2266e647", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150488, "uuid": "7b06f9d1-3a2d-4050-be01-eb1e2cedd206", "comment": "Malware payload (Rhadamanthys)", "value": "da71fc044e69b999a35b36b52c6f3c9459c52e3faee11a39bdc60b3a80a530f949bbf9b1449619a6fd97b72069142c18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150488, "uuid": "4e05ce0a-7b50-41fd-8bda-e3c0987eb796", "value": "T162A33904AF12BCEC09A6330B7B86527A4701525F688D7DDDD5A7EA3F63247218CA27C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150488, "uuid": "7ad4c3a7-8080-4908-a13f-2d9859069504", "value": "1536:GDB7eKg20hZPLrmr84cY2MG+ufA0VUCsC6BkQWJ+aY:GDB7b0htchz8sC6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150488, "uuid": "dc9cdf21-4c24-461b-ad40-345473410869", "value": 102713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150488, "uuid": "eb9ae35c-5510-48ca-8845-c55c4bc10eb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150488, "uuid": "f082a890-e796-4438-895b-f01eb75780e7", "value": "invoice-1637482117.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef69b4fd-af1d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761120355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120355, "uuid": "9572aead-a0e4-466b-8608-5a27cafd4f8a", "comment": "Malware payload", "value": "b5772c6c7e25b6377630ccdd48fd0216", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120355, "uuid": "7fdca4cf-a76d-4561-aa1f-e08c664ac012", "comment": "Malware payload", "value": "9f8bfabe3aa42d32b14589691c4ab905e4edee5665461b22161597a3dfbd306d", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120355, "uuid": "3fcad4a3-ac4c-42c6-9cf9-6a6e72da7be1", "comment": "Malware payload", "value": "00396f722d10c1a66f6dad70a8394eb6f5016fbc", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120355, "uuid": "fd6020ab-70be-4a5e-97db-27825c0cd45e", "comment": "Malware payload", "value": "3670ce10ebf348f0338dc9a8b2f46c7774efdfb5acd591defdc34bfc6cadb8a04e7240afda1e36d223c8c8b6febe5c09", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120355, "uuid": "b8dd5986-c54a-446c-b109-c85e91650b49", "value": "T181924B25EAE3112A8643178A37A7D24B3654DA039359D65072CF170E5F8A3BCD3F7368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120355, "uuid": "c293c2a7-15eb-49b3-b9e7-40ed2c208811", "value": "384:TZHY9jaJZHa9+IZkbId+Ip9pcKg8KdnafvzqQuKUCup2PlDsu:t2EIZ735Q+veQ9Fup+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120355, "uuid": "a996ed36-f5ab-4b50-957e-4930bc4bf74c", "value": 19674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120355, "uuid": "922671da-0469-4ccd-8caa-6e375453204b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120355, "uuid": "a43f6d01-6a72-4706-9b76-823cf124e57f", "value": "IT1404010920785.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d392f30-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1761137209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137209, "uuid": "6b441351-2e92-4f84-bb1a-35f75161c0b1", "comment": "Malware payload (GCleaner)", "value": "e79a2ca4d3c75fe98824183759ca8d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137209, "uuid": "6bf1c069-8adc-4c29-ab7a-63d60f9bea1d", "comment": "Malware payload (GCleaner)", "value": "a071db1acb51e629aeb194a9a960116581c3cef7be5dd7af11d55a291fe90357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137209, "uuid": "f8a5b963-89c3-4488-8387-ecae43dee094", "comment": "Malware payload (GCleaner)", "value": "547a87e91e4bc5a602b6206e7a28aba2b131b5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137209, "uuid": "2503865d-dcaf-4216-b572-3cace3131685", "comment": "Malware payload (GCleaner)", "value": "e19ca943ba99b540747a86cb41a028e5a2f1c538a76620b70967a8606a20e0a51fa44b8730b0abc8b58e63c6753b99ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137209, "uuid": "adb7a5aa-62b6-48d2-ac66-069e651fa91a", "value": "T11E06E0309DD24CA1E0273139C81FB195E51B7E4EFAF6FBE40DF329146D2A1E14AB61A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137209, "uuid": "36df859a-ed60-4015-83f4-3a17790adb40", "value": "bdd3b011b3121d6f72f040e7e4e18cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137209, "uuid": "550f92e4-1a27-494f-a4ff-f1d963fbecd6", "value": "49152:gnqlR5xxCzkrlL3hJOjfHijPvGfpLtw69nFxEuR9pZSa56Tl3F3Y7GNCQBa3f:go70+RhSfSeVf4TNF3gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137209, "uuid": "d402bab0-5fe1-453e-af86-60fbcde6468e", "value": 3675424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137209, "uuid": "50da9bfc-4919-41b2-9290-6e342ef0d133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137209, "uuid": "02872d2e-7967-48ab-9cd1-0a703bacd942", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10443532-af49-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761138878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138878, "uuid": "1545c107-7738-477e-9911-9d9a46a8fbaa", "comment": "Malware payload (Formbook)", "value": "14eea7cd0fa442a3f1cad8047b611d3d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138878, "uuid": "3ddab12c-d057-4531-aa8d-33882c34cfcc", "comment": "Malware payload (Formbook)", "value": "a0e703cd3ccd081b547b61ac1333404aa56b2b5c3b03e079dbe59975ed5b5403", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138878, "uuid": "e6d3cbfb-40a2-4727-8e79-6c56cacf283b", "comment": "Malware payload (Formbook)", "value": "2d335b0297a32721989580be73c12174d7cd7f55", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138878, "uuid": "aea0ab8e-3f08-40bd-aef3-c704e63b8b08", "comment": "Malware payload (Formbook)", "value": "6559568d4f9084c1499798355a6bdced76507cba49f892e46a700f6fb17f395eb7adaaffb259edb712aa8aa6908fe6bf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138878, "uuid": "a00eeb46-771c-429c-a072-d80c9f5525f2", "value": "T1DE55BF027391D062FFAB92734B56F6115BBC79260123E62F13981DBABD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138878, "uuid": "1d9101fd-584b-49c7-8cd3-4855e2df3318", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138878, "uuid": "c3f4260f-d0a5-435b-99ab-35bc9aa78907", "value": "24576:35EmXFtKaL4/oFe5T9yyXYfP1ijXdaTRzttUgJTxNIamLOhLue:3PVt/LZeJbInQRaTRzEKTxuhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138878, "uuid": "0457ef3c-3174-4d88-8ab7-3e9f63e016b8", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138878, "uuid": "de213f8a-68f4-4866-9b3a-b46cf237ad24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138878, "uuid": "fcb68e7c-0a93-4652-9010-429da46d5011", "value": "\u03a6\u03cc\u03c1\u03bc\u03b1 \u0395\u03c0\u03b9\u03ba\u03bf\u03b9\u03bd\u03c9\u03bd\u03af\u03b1\u03c2 DHL 23647892145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b468103-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137743, "uuid": "a4204706-1857-4234-ae93-a2321601dcf5", "comment": "Malware payload", "value": "6270644590c6cab3cf59c9e9a1ae75a1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137743, "uuid": "0d6db83e-1d46-4704-9fb2-1ccde5278aa4", "comment": "Malware payload", "value": "a1946fb8c1ebfdc5abc4f50289a6bc36a6b52a49034919086cbb381da963e542", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137743, "uuid": "ba79b9c4-6ee8-4a52-815a-1b72157ef4d3", "comment": "Malware payload", "value": "7a98422392c4563dcf7059e298c5517f534b2de0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137743, "uuid": "326f6c08-ea3a-4dbd-aa31-295160b748be", "comment": "Malware payload", "value": "5049ef618d4f3c6ce39a640145abba11edf8717f7dc11d1748c2ecc991f3d1716d74e2db4dcf1cdb54cbd01884cdc5c8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137743, "uuid": "7178e78c-3300-4535-a006-d825bfb2beb7", "value": "T1DFB0928628929A6F5B4090536169C14F0899108C8C9A979C4B00181C284C95C32AA2A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137743, "uuid": "8ce777de-4b83-42b8-b1cd-d94405ce6c54", "value": "3:HrJJyQZTGNYQy9zG4rU5MgVcDaHF5X7ZkwOaHF5X1:HGGG2rtbaHL7ZIaHL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137743, "uuid": "40aa4960-1434-42a9-9187-491044cdbd4e", "value": 116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137743, "uuid": "5211c965-475c-4046-a340-8d72ab197c75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137743, "uuid": "9a48a512-b32d-4ea3-aa2c-697795540726", "value": "shell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bcccc9-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150647, "uuid": "14ed4036-1335-40ac-bf15-a56b13e00fd5", "comment": "Malware payload (Rhadamanthys)", "value": "524a8d8f2ca9e126d50f19b7c0795af9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150647, "uuid": "e4453a0c-3026-4f59-8c68-dbfbb9af4874", "comment": "Malware payload (Rhadamanthys)", "value": "a1f5201325d68313b9b54e433a9f54888c1a64f2b2ecd352ab2c48bac74ba783", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150647, "uuid": "73c9b3f5-80dc-45c5-b7f3-38e6db4bab16", "comment": "Malware payload (Rhadamanthys)", "value": "20100d7ecbc623860aad07d7ac17834914a928df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150647, "uuid": "88895de0-6e8b-4f72-8457-f9c5c854447c", "comment": "Malware payload (Rhadamanthys)", "value": "1b5a41bd804e4c8daa8a35c180a92d7bc50bda105efade5ca4d27e23f50d4e85156bb564ed56ecfa292ca90614c84ab0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150647, "uuid": "35d20c08-c871-4a05-9b27-500353fc08b7", "value": "T1CCA3E78CDE21E07F174DEE719D6852D2478BDA2D88CD47C94F272A1A8154E1E1CEE8CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150647, "uuid": "07f328d5-d61c-40e7-bea4-2e442097318b", "value": "768:GDhd0i7J4sYKgY/CMNfWdeIZmTkdkcrXeure0SYHOQw3Ab1OyySLAuAAroQW+FFP:GDB7eKg20brzre0SDjAb4yy6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150647, "uuid": "d8c11158-299a-4ad4-897f-f31b01467093", "value": 105438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150647, "uuid": "83934c7c-4b6e-49c8-808a-cfa06e379d2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150647, "uuid": "49273721-3919-47cf-9517-34750b986155", "value": "invoice-1637482117.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19278829-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137605, "uuid": "9d22da15-49c5-4d72-95b7-29a8d19b9021", "comment": "Malware payload", "value": "02976b662583b0a11d055e3608fc58cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137605, "uuid": "6a31caea-8de4-409d-9e7c-9d5a65503179", "comment": "Malware payload", "value": "a29c7e60eec9193054a2e3b13d1c801c04157703329a6bd41dd890341fa034b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137605, "uuid": "cad5ea8b-a3dd-45bd-85cc-8564a38c328e", "comment": "Malware payload", "value": "3375a9f02b1eacae4bdcd57f74a8f8bc6d3ffc5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137605, "uuid": "fe091034-a8fc-4614-b244-2532f1d9463a", "comment": "Malware payload", "value": "a7ea4bbd930c7f4ee5eb1348b034a52b4562e808a9db5423487f54cca751507ec612b0aeaf79de70492106a7baafc02b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137605, "uuid": "15a58317-1570-4764-8128-0c3893944d96", "value": "T1C80633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137605, "uuid": "2d6d0ca4-fbf8-49b0-bd29-c428056041cf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137605, "uuid": "3921e4db-bc40-4488-a87c-19b7866afc46", "value": "98304:atT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:a2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137605, "uuid": "69e09bf0-dfa0-4955-8caa-992497102ed2", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137605, "uuid": "c5cfdff2-3d8c-4f7a-93c9-80cc3ba08a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137605, "uuid": "92669913-e931-4f75-b878-272030015205", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787e1d36-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135617, "uuid": "daafbf92-a96f-4055-8e7e-0419f8445b33", "comment": "Malware payload", "value": "106a7f9858085af2ac73f5126cd7896e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135617, "uuid": "0e486631-b1e3-4a83-8b3a-3c49ad4110ba", "comment": "Malware payload", "value": "a2a8fe64eae1b3b5d28735ffdd7d33c3e41ede456086f210956fd1c7392a56e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135617, "uuid": "eb134858-7607-45bc-9403-d22056740de3", "comment": "Malware payload", "value": "cd8b5f34dfc6bcd85e26c43ad95a6b19fd0d02ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135617, "uuid": "38b0b6ad-84c8-421a-ab8a-2b54b90595c0", "comment": "Malware payload", "value": "35b807d2c63116d326463774bd418668888a5087e333eed2602f17f7b91f1cd6b9bc87a11c19af0ad79ede927559a651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135617, "uuid": "85c4bddf-2b3b-4b7c-8289-a53b4f571166", "value": "T19274F1027BD2C6F9E0A22A3285C5B7A129BDFA250F2986C79BC00E055D757D5DB3D2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135617, "uuid": "d31e6dc2-3ee2-4a48-acdc-4427a5b624fd", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135617, "uuid": "62365ce2-2c00-4177-83bc-01deb52ef5b8", "value": "6144:MCGR3amwfiwk10i/qwNiMnfUBhLzN4+upaPgBVuxsCGODeRnfoH+mtl8f9:M5lSir10iezNzupCgBFOuo+mkf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135617, "uuid": "49c14070-d1b8-477f-9acb-b34c6dd998da", "value": 350427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135617, "uuid": "5f337b7e-0254-466b-8f86-2617277dff1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135617, "uuid": "6da2ac76-0c07-4f89-9b1a-89e3f5a2e14d", "value": "106a7f9858085af2ac73f5126cd7896e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6774851-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761131077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131077, "uuid": "955d0491-5181-4cfb-b4ef-d8eabe1818bc", "comment": "Malware payload (Mirai)", "value": "6b57b1c994153877499c7b30b53323e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131077, "uuid": "b3724b9b-6c77-4cec-9bd9-a5b3cbcedbe5", "comment": "Malware payload (Mirai)", "value": "a2d3a31b8b57ee115aadc3ca009c198fa8d4bac00483822b75d4ff61aee3babc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131077, "uuid": "7ec3e1c2-9e95-4714-88c0-3c62d77cec1d", "comment": "Malware payload (Mirai)", "value": "341d07738ceeca312c29c2ee2af8285384d045c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131077, "uuid": "027788ef-40d6-40eb-86a9-c1c7252e2fb2", "comment": "Malware payload (Mirai)", "value": "92e4b83a005b96cb63a30673d12e50afc7f154011141a12debce9c907a47340105bc704de5ae6effdd34a420cf8ab205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131077, "uuid": "27c20ad7-167d-40ab-be8b-33207d70e562", "value": "T1D4132A96F8C14B6AC5D1127AF66FA95D3320A3E8C2CF7303CD601B61769741B1EA7E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131077, "uuid": "61306a2a-83e2-4b82-a6f4-88d7f14ae2bb", "value": "768:SO9xa20bBx99FJJPuzTDyQSCchpjgrHwzo5NH5dPQt5Rpj1ZFLUavNGwbZ010U5f:SV243FJJPuncharHwCH51Qt5RT3Db+1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131077, "uuid": "d9dac80e-6cbe-4622-b94c-e5df30f63b4a", "value": 44584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131077, "uuid": "7b618f76-3f2f-4082-8849-77fdbb003dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131077, "uuid": "5de9658a-560e-4890-8971-8b1a68714b53", "value": "botx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ac554f-af1a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761118839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118839, "uuid": "a3bc46e7-65c5-41b2-8aa6-41e0bc043866", "comment": "Malware payload (Mirai)", "value": "8ece323b03f4124e65b2026986b724f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118839, "uuid": "315721a0-0789-4e12-9630-7423d04a0d42", "comment": "Malware payload (Mirai)", "value": "a2dfe9547fa03ef3c81204e194eeed6011be88a2df1c8b4205ff0c54b6b1eb9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118839, "uuid": "af5c1477-cc7e-4d62-b8bd-f179a13e0c66", "comment": "Malware payload (Mirai)", "value": "d7e9d9f583151918b6be4f2483228dacc2a090cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761118839, "uuid": "13eb7cfe-e312-40a8-92d0-d3a5d04f4466", "comment": "Malware payload (Mirai)", "value": "29e24c01cc45ef4150cfbee89dd6e96dea0e1ef03c2a58d4fe4c6594a168314124ce3f2aa5dca3726c29905265abec58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118839, "uuid": "ce498f26-880e-4393-9e44-dbb81012bde2", "value": "T129D3BEEB724B5511C46246F01BD38F8E3F6362128D5BC9EB2D0DB63A28B61DB59077C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118839, "uuid": "b53a60fb-c13c-48dd-a8c9-09bce01be920", "value": "3072:bdJlYF3PhEmw0QHdOes8DEgEoeBiugJnYq:bFYFpwns8c54Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761118839, "uuid": "d1bdc5b9-dae0-4c20-b4c6-a9e970f96183", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761118839, "uuid": "0b534126-1f10-4c91-bacc-cbecb2345abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761118839, "uuid": "c248d5bd-b319-4121-9782-1b7973c08024", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee92a508-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150418, "uuid": "4a57ad2a-0058-47d1-b05c-2fd23bd78405", "comment": "Malware payload (Rhadamanthys)", "value": "80817c81073653562acd17b72e911875", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150418, "uuid": "aa627227-27fe-4db6-85f1-740c30d162f4", "comment": "Malware payload (Rhadamanthys)", "value": "a31ae9cf3ffccd0d53cd69e0de93ec9b4629920cc5b2c3cf9414077bb181bcda", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150418, "uuid": "dbbea8ea-7582-4e22-9209-5a32882ccdab", "comment": "Malware payload (Rhadamanthys)", "value": "22e58b9df3e0399fa94151ca102c1d6e664d8962", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150418, "uuid": "3cbe310c-f570-4aae-900f-ba38d1436343", "comment": "Malware payload (Rhadamanthys)", "value": "2b863b8c7bcab03d9cd94ac0d1591edb007efbed588a542ecb8242a0f1426dca738ee5269483b50eb37c3abf831ef369", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150418, "uuid": "23502040-55e0-4e3d-877e-ae48fbab22f2", "value": "T1B2B31C09292FF4B6548FB488DC90268C4D2ABF8D05B192CDDD87BB71657B1618EDC2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150418, "uuid": "087ed6d1-82b3-4991-99a1-198dad39e683", "value": "768:GDhd0i7J4sYKgY/CMNfWdaGm8rXMdr0FCUHtFRARAHOaRSLAuAAroQW+FF+Ec+0G:GDB7eKg20Y8rUr0FCWEAHPR6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150418, "uuid": "c3b74c66-adea-4c1f-928b-2783b46e4ba6", "value": 108628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150418, "uuid": "98b98ed4-b86b-4c1e-b0d6-08ff98f9cae4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150418, "uuid": "811853c3-5eb7-4612-bbd1-41b45b4215bb", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beba29bf-af85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761164941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164941, "uuid": "2ccf7ab1-b552-49dc-ab69-529f66f1cf74", "comment": "Malware payload (Mirai)", "value": "d51dc3115c1c0914c2c5e29b3393d085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164941, "uuid": "9d8c38e2-36e1-4514-9b1e-1fd6b7b2ed49", "comment": "Malware payload (Mirai)", "value": "a5357cb8f6566613be9393a2def399b617ef91c2bc5ead8b8c1ff0f50d3f8dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164941, "uuid": "18265e8b-5ee8-4ce3-86e1-5cfccb476090", "comment": "Malware payload (Mirai)", "value": "d50a9f27364bf2c73961bcdcefcf62b70d8bdb6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164941, "uuid": "8cf30ec3-97e6-4a35-8f19-9f8d0f203bd7", "comment": "Malware payload (Mirai)", "value": "90acfa1dc5c459a65cc52e38e91786bc8c524e96bfda3a1abc6106b22d25772bf47db1cf3375c7bff47da81839e9ec75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164941, "uuid": "a44b7640-b6b8-498d-ad31-84174728e5b9", "value": "T17113E0AA031144EBCE81F0F8DFE44F912B292F1BC90F8D566962FD57CD8A1A47CD2649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164941, "uuid": "716bf4e8-bcbe-4b0f-9077-980f28b17b9d", "value": "768:lH63cEtjr/ciLDEPv3PPMRMdZrIopQOKwpo0AycP1/s/oKzcJuKqJgGlzDpbuR1Q:lH4004ZrPpQOKwpo0Ar2l+IVJuuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761164941, "uuid": "236f4f1d-e2c4-4ab1-bb8a-8032d5951e65", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761164941, "uuid": "9a6a51df-4131-4066-99e4-194534454a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164941, "uuid": "9ab0a321-fd07-45fe-8381-c25b72950a35", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5d997f-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137343, "uuid": "854a1694-8aa2-48e7-ac52-4ace4e9767fa", "comment": "Malware payload", "value": "ad5d7c0072f91f01a2bb64b1485b4b33", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137343, "uuid": "e792b15a-20d4-4f9b-91fa-fee7a2988768", "comment": "Malware payload", "value": "a556e00a045dc49e98b2ededf7fe224c3416d80dc005855edb6b6db2657d8a27", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137343, "uuid": "fc4e3dd7-4a9b-4f57-9ce4-d956d893274e", "comment": "Malware payload", "value": "2a4d83ad5e7a56fda243531128f5bffd3cc4c8ce", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137343, "uuid": "5932bd56-7592-4220-9b6b-fcb2a0786945", "comment": "Malware payload", "value": "3b3470e3c7b379c6020b443a730bbc826780b71d365cfe9f6161749613987c898541aca64b93bac0c58ff3c05c4f1ea4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137343, "uuid": "c3783d38-625d-40e3-b3e5-19691e3ecf5e", "value": "T173F09ECD48324EBD0FC9C873F5546186B00AA0CCCAA2A5D51B9225DD4D580D836EBB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137343, "uuid": "345b75e1-616e-48e6-a6fe-aaf8671ecf20", "value": "12:5YVJhZnBLBiLBLB7r40aVHAbr4OVlCk6Pp:gVcF5r4TlAHZ/ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137343, "uuid": "318bc914-bd6b-4666-9a73-97c4b7e7f6bb", "value": 512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137343, "uuid": "c40ab197-885e-4691-ab89-ee13f28209fd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137343, "uuid": "d3b47b0e-bf7e-4815-96e1-45714d8baed9", "value": "windows.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17628b50-af80-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761162513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761162513, "uuid": "8fe7b471-a6ee-455a-9711-00888f64135a", "comment": "Malware payload (Mirai)", "value": "1f040fd6c3ff0d01d6dfb0db1178a710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761162513, "uuid": "acacb56b-bbdb-4387-9d5f-cbddb8dcfaf2", "comment": "Malware payload (Mirai)", "value": "a69340fa5b6dc034e1db832bfa80003f985b38f4a13628a1c1ae343b05ffcd2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761162513, "uuid": "a2511c3d-599e-4ed3-b2aa-da180083856f", "comment": "Malware payload (Mirai)", "value": "ebffdad8f95120f7e4fb2c949a42b1b1254fa657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761162513, "uuid": "5980f4b7-fcd8-4904-916f-939e68ad2f19", "comment": "Malware payload (Mirai)", "value": "512d99b52dd88e0d554b3a120ef050fe6d43c4fa5f41c98f79f11f225de483e562ac4b0a93b92f759baa8a35e8852be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761162513, "uuid": "3fc822e4-046b-4b5f-8173-425c701245a5", "value": "T1ABF39C22DC256E98C714D175F0B0AF7E6753966142871FBA28ABCBB58043DCCFA067B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761162513, "uuid": "ead93d27-db9e-4aff-a000-2c6a055a98f8", "value": "3072:Ropk29T+qKaxlxrleWTXNiUxFa3W1YpAgsnsMwiU2BboH9hVWSO43krG:RoakfNqDsnsMfNifgSlka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761162513, "uuid": "a6fed29e-9047-482f-819e-932d9d181033", "value": 168068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761162513, "uuid": "b8918082-2f27-46dd-a8bd-f08ac4985d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761162513, "uuid": "9ea1be9b-831c-4559-a034-d419f2b210b8", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6653b2f6-af66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761151478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151478, "uuid": "e97cff84-a76b-4d2e-acc5-6a3e73b8051e", "comment": "Malware payload (Mirai)", "value": "2ac4f220f5976d67b31659c634ccde62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151478, "uuid": "76865d98-3c70-44cb-9b20-f02f4688049b", "comment": "Malware payload (Mirai)", "value": "a7f595bfe78c38172e11e1b161acbe151abb72b7f178cae874127b64aef6fc69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151478, "uuid": "a97ff4d1-b146-4b6f-9391-635bb2773261", "comment": "Malware payload (Mirai)", "value": "d99cc6e06a43f8d44977ca3e074268cc4e796001", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151478, "uuid": "cca6fadf-ef41-46d8-a9e7-78b769c956ea", "comment": "Malware payload (Mirai)", "value": "2cb21d92b0568d216a27fd9ba5c327181738e7670b1584cfe01c489c4ecb9e671536dc881106c16e0367cbfaf25faac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151478, "uuid": "d4217de1-58f7-494d-83bc-218858e9bbc1", "value": "T11604885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151478, "uuid": "4b3b7714-35b6-478e-8ff2-c84503175dcd", "value": "1536:Cl2JvnXPvLWQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/McwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761151478, "uuid": "79854eef-0c0d-486b-bc01-e45d77a9f65b", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761151478, "uuid": "14ce1666-bead-436b-9dc0-b9af08d08383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151478, "uuid": "888fcccf-2a2e-4931-8a02-1f98f2ea020b", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02398ca3-af05-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761109649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109649, "uuid": "a31cbc85-f181-4ddd-9813-8bf3b91c5659", "comment": "Malware payload (Mirai)", "value": "3dbd64f4db3eb390f423ca93e4a9f6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109649, "uuid": "834e003d-f333-4cbe-bf30-1a02d8eb3875", "comment": "Malware payload (Mirai)", "value": "a807e41863e8d6850cfa98bbe4a15adeeb328c6253fd4eeed0f0eb946a5c1cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109649, "uuid": "e9db28dc-62a5-42bd-bb3a-f661545b0f60", "comment": "Malware payload (Mirai)", "value": "dd7a4bf0395e5bf4d38a541b105b07173ba3e7e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761109649, "uuid": "9ae1b1bf-4c9d-4d64-8322-ae7df9b38ea6", "comment": "Malware payload (Mirai)", "value": "0194dc4f1d430b4d946e7750bcb134be1c7e9464b975d0570a731daa79b16a0ff8310041a742bb8eaf383f4773e50aca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109649, "uuid": "6e5160ef-1029-4d5b-ac83-fdc83b10a65c", "value": "T1FE93A51A6E258F7DF75A427047B78E215A4477DB2AD2C142E16CEE412E6038E300FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109649, "uuid": "88825347-8f1d-41ee-97c8-5800a924d369", "value": "1536:ian0C80iYUVYeQSgOM8KEiwy6C3/kTPZwpdIR3dhQz2GsuQK:6CvUVYQM8KEKD/kTPZwpdC3dhQz29ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761109649, "uuid": "40379074-521c-4575-ba55-58fe900ffa11", "value": 95456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761109649, "uuid": "6bbeb205-1893-4a58-8214-6842f8e376e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761109649, "uuid": "0b997ac2-2592-4424-a7d2-a4a5254f5ab5", "value": "kwari.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5292de1c-afa0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176356, "uuid": "80cb0bfa-a679-46a7-9ac6-4b9809bffa99", "comment": "Malware payload (Mirai)", "value": "4072aa66eb37ea98e939208fdbf8dca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176356, "uuid": "f16921ec-b8e8-4f80-b331-35acc8ab14ce", "comment": "Malware payload (Mirai)", "value": "a8e6f02362f973adda0cf4dcbc1c5c3809ee7477a7967287893457b8c5eb02b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176356, "uuid": "2d53a22b-e2e7-43b8-866a-a2e6c181daac", "comment": "Malware payload (Mirai)", "value": "d69fdfd08d84232b5088493f893e0b8d86e95bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176356, "uuid": "3029c9ee-a1cb-43db-b1fe-5e124999770a", "comment": "Malware payload (Mirai)", "value": "ecbfae8afa27eac8e1fa2d3fea288c4fad863548095faa4f11c70a7ec446ccaeaaa5cc2da60c85ea9233a8d58a5de4f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176356, "uuid": "44ab6b14-28a6-4e51-a52f-4754e912fd5d", "value": "T1C323F2DFED2899C5DC9C6CB1629847D26D6460C03A9E8BDEA3590A50C7732063D9F3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176356, "uuid": "79e83119-a6a6-4dfd-a761-8ff38ea4f637", "value": "768:t5iXeMKbg0d5hMDS7V2tEvdZyeQli3KeEciYAhM9xe7Gt+yE832Z0G5BN+0PUOwa:mXeZh6DSJLZyvlOPma46cyNKHV+0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176356, "uuid": "d3f1b9a1-d48c-4f43-aa8a-93b561e692e5", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176356, "uuid": "e145ac4b-35ae-47bc-8395-773dd4d7531f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176356, "uuid": "d04f8715-4c1b-420c-8d90-2059299a3775", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d01b50-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761150321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150321, "uuid": "fdbf76d3-6d41-4e94-a83f-b5f28a82a951", "comment": "Malware payload (Mirai)", "value": "d86c415bd2a8a5bf3ef85a35aaba03c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150321, "uuid": "a46186ca-2702-41e1-8ba6-c16c91bcab86", "comment": "Malware payload (Mirai)", "value": "a8eea846b9687ac1663b6afbcae9b599d157bdffcc6038301a87a5590c1ef1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150321, "uuid": "c6024b46-d9d3-4c37-9178-3a4225d72989", "comment": "Malware payload (Mirai)", "value": "682cc396e4a9e91990f32a0ea0ea1def5dd445b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150321, "uuid": "d49065c5-d369-4a8a-b766-05afb0e75ebe", "comment": "Malware payload (Mirai)", "value": "b2ca7d13e7e78e3592db40ab5c881b8e1e0082d26fe38a829572cef7c83c06e803a2e6efab47309be9540b0328e9fb4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150321, "uuid": "9b732c2a-4ae2-4cba-b424-5e92c47fe7fc", "value": "T158E329DBF800DDFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150321, "uuid": "4ae31b6f-3ca5-4209-bf7a-256fd3f56ba9", "value": "3072:jRsZq/hrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:tsfnfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150321, "uuid": "cf6cde60-3501-447d-a1b0-79e5217f61a5", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150321, "uuid": "0f3a7363-4099-4c91-9a4f-5b11854946cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150321, "uuid": "e53b6c5e-ac71-4bab-b8d2-99c532f47808", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5664fda-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761113386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113386, "uuid": "7b4c1697-3445-42d7-990d-7a0e2994fc9c", "comment": "Malware payload (RedLineStealer)", "value": "3f3e083185d99abd3ae67d88876cca92", "object_relation": "md5", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113386, "uuid": "8dbcf652-83b6-41c5-99ec-6f248e9cbffa", "comment": "Malware payload (RedLineStealer)", "value": "aab7318a5f124ef93fd0cff68ce357d4b07d52909d8ee637099f472973e20fd7", "object_relation": "sha256", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113386, "uuid": "08ab1362-fb15-49ab-bdf2-a97887733d6d", "comment": "Malware payload (RedLineStealer)", "value": "736002884b4b7ce97972c78e926cf75e19c02f74", "object_relation": "sha1", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113386, "uuid": "6db1a9db-4138-49e9-9f1a-9ecd8139ac29", "comment": "Malware payload (RedLineStealer)", "value": "fb106b2ba0192a9488975e26a213c73a31a8e87f88aa2d1ae8eab700ee8fa3576d640e7c0aa529e7f5b24cb1bed4dc50", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-189-163", "colour": "#BCB0AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113386, "uuid": "70a49bef-f86f-4074-b1dc-258370c44516", "value": "T11A552320B1D1C2B3E0B709B428E5C635493572B25BBA96E3779C67F92F013914A772CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113386, "uuid": "2c1f0231-5e6f-4f29-ad46-17ec2e1d340f", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113386, "uuid": "bf2a08d1-c89b-4a22-bfa0-4412048023b0", "value": "24576:Xk70TrcqEeqy3YavrzRWrQE/aKqdm6BqizE7xQYJiEVIQNKcLx6ZCz9M52QbW:XkQTAqdqyIajTyapHBqizKTDVIQNKcQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113386, "uuid": "8c33297d-03b0-456d-814a-3d0833398736", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113386, "uuid": "f7fff49e-ca3d-4487-aee2-b12022420d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113386, "uuid": "c71b4570-f4fd-458a-a9ff-ad06630f4f2c", "value": "aab7318a5f124ef93fd0cff68ce357d4b07d52909d8ee637099f472973e20fd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f010f791-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761131093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131093, "uuid": "8cfc7f8e-817f-490d-be82-13c1667cf535", "comment": "Malware payload (RemcosRAT)", "value": "07af87ddad0716c0e70d507c8e019f4e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131093, "uuid": "c3e38001-e3ba-42e2-a267-cf4661773822", "comment": "Malware payload (RemcosRAT)", "value": "abd99bf17b7cf13044a064cfd6d73d38a19706ba46222e05e4893b188fbe9cd9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131093, "uuid": "b6fe5f15-12d6-450d-88df-06e38e5fbf63", "comment": "Malware payload (RemcosRAT)", "value": "d37d44e9138fd4c447c0ce376f889cb64459eb3c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131093, "uuid": "5e53cd62-b059-4e10-9474-1b082f730ec6", "comment": "Malware payload (RemcosRAT)", "value": "e6315151c03a3280230421ddcc3f0031274b03f8b703c17b2c7c6f18c75808b833bd62101bdfdcc42b4e70b0505a77eb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131093, "uuid": "6d39540d-e602-4aa8-ae56-ca54c9f1086c", "value": "T106B152D6C782EFBD731B06E422552097469ADBC7840820F4FD6BA92B344DB1441EBECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131093, "uuid": "5a2af600-4cac-4868-a073-5325f3ebc8f1", "value": "96:GNlSKaPRTxe9/8+Ra8nfGh7L871qr3c1sYQgWCKJx357kGPx6bM7zsc3t:Gr7aPRTxuER8nuh74Jqr3c1sYdS5Qsx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131093, "uuid": "77816374-2a2e-458d-9400-38cdf86b44fc", "value": 5240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131093, "uuid": "896e2d82-dc79-43c5-bad7-70f9e68b0cdb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131093, "uuid": "35f69b76-0506-4490-8f05-3bbe1ef8e2f1", "value": "October 2025 YTG Dealer Letter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea48d84-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150606, "uuid": "e8d0daf0-493c-4dfb-9a5b-70074fa887ca", "comment": "Malware payload (Rhadamanthys)", "value": "40735cf5d34cf32b932cc7bdc480f742", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150606, "uuid": "8c7be1a3-660d-4fa9-9733-afc7d43b611d", "comment": "Malware payload (Rhadamanthys)", "value": "ad22d783800323dcbec710a506d0ae2a99058298e2857555c60e3a6ad85fcd96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150606, "uuid": "f2bc0352-ebab-456d-8eaa-57ef5a93e421", "comment": "Malware payload (Rhadamanthys)", "value": "2606dbabbc66ce197508fd47762bfda4fd7756b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150606, "uuid": "8936dcd4-4211-4401-8374-42a6225304b2", "comment": "Malware payload (Rhadamanthys)", "value": "659d7a3c840dcbd9b88fd6e84de6ba614a07d659be6467b2ba8bff645b5c415beece92c0b2c997b852443e0ccc31da76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150606, "uuid": "4b8aa89f-3236-408d-ac36-943dc184a5f6", "value": "T182A3194BAE439DF805F4C2E4599E93E449C91A96BA8191ACDF0BB63074043973DB2CE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150606, "uuid": "884e51b0-210e-4cda-8a7c-e33042ba71f9", "value": "768:GDhd0i7J4sYKgY/CMNfWdasGNlTRrXSrrtV6HHuPAi0LvSLAuAAroQW+FF+Ec+0G:GDB7eKg20VCrertV6uPAiYv6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150606, "uuid": "cf4d9436-d9dd-406c-b206-cbdc4eb5a5c9", "value": 103416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150606, "uuid": "8a298d45-fd57-484a-96c6-bb9530702d61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150606, "uuid": "d9c4334e-6022-4a90-b24d-bb2a41e78a8d", "value": "invoice-1637482117.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e96439-af85-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761164708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164708, "uuid": "60b6e21e-7e5a-4c4f-a8bd-bc515e5829b9", "comment": "Malware payload (XWorm)", "value": "10862ddf49e01af8e611d72fde80e4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164708, "uuid": "032b2210-a719-4a81-a0e3-af8e7aa2e625", "comment": "Malware payload (XWorm)", "value": "add6b57e32073071e04aa9b1cc97b4e2d1e670c3634d9a96783cb7c16c32530e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164708, "uuid": "e51b2253-d94a-4afa-818e-b578ad710afa", "comment": "Malware payload (XWorm)", "value": "4dbee4b3d1c03d69957ed806b2903f3ef1c03380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164708, "uuid": "f24add93-7d73-4a07-a093-877ecb3203b4", "comment": "Malware payload (XWorm)", "value": "1d79793eed3d93b848da4df5841211cb099995ef70f1860ba530803894e9785ac2b978363fcf984fae7c3bfc8a9c0056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164708, "uuid": "49bec2fc-8938-4a20-a5b1-9a648a76cdd3", "value": "T16264A59C365071EFC857C472CEA82DA4EB5479BB931B0103A0A719BDEA4D8A7CF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164708, "uuid": "8edf71d8-754d-42bc-8096-f7eacf815010", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164708, "uuid": "39a5ec84-f095-4e4e-b762-37e135163618", "value": "6144:gCBbwvYRFOk/BggMbOim8OzMTWSKsBOvg6wpaJ14TcdGGqStKEbxI:KYREAB/im8OzMTWSKsBOvg6wpaJ14TcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761164708, "uuid": "31c96508-bcdf-476c-ac6c-ad3418d6ebc4", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761164708, "uuid": "1f4cb815-85d9-4fe9-85d0-de51119da176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164708, "uuid": "8a3278dd-fa7e-4683-81b2-68b8d2a4d6b0", "value": "10862ddf49e01af8e611d72fde80e4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25813f27-af56-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761144497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144497, "uuid": "9657f3d8-7d8e-438a-8f4e-90fadff92786", "comment": "Malware payload (RemcosRAT)", "value": "c1832ac494889272a2b7bce67fa070fc", "object_relation": "md5", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144497, "uuid": "42df056f-0678-4221-a14e-0d4960576deb", "comment": "Malware payload (RemcosRAT)", "value": "aea570ebce97855285a28e3e1a091511484201cd7ad4ca9a3a0e5cb8d29ba82b", "object_relation": "sha256", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144497, "uuid": "8dc8fb9f-15e2-4259-89ef-f7de144357a8", "comment": "Malware payload (RemcosRAT)", "value": "d6a0165d5141edf5afc4da91bb5ff93792d56ab8", "object_relation": "sha1", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144497, "uuid": "3abf3e3a-862d-48ea-be4a-adae8640fe08", "comment": "Malware payload (RemcosRAT)", "value": "cca4a767fb2e02b568aa296a4521cb84ebeae9ae0611b75863cb761898be00c26cf46fe6f3a1de1f50a43711920fb29e", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-215-164", "colour": "#8EEDAD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144497, "uuid": "0af55b7f-6ea2-4467-b227-11dc44cf8772", "value": "T1715118645E9F2E477004BBAAB189E97CB64FA17FA275259A9C48F32528D3C3C070C247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144497, "uuid": "96ef029b-e3c3-4b2a-be8c-a6f55fa5b815", "value": "24:QrwGFEqr3bw22dQPGIgIIRxronvebwoStouRbwRJqKwWswEronvebwoaz3bw4UId:5ArkQPiUvNZtBauWRGUvNfo4U0wjtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144497, "uuid": "de80c7ba-b818-47dd-a102-37188d8f0a89", "value": 2709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144497, "uuid": "15e31ddd-edcc-4953-bf32-93b82544b2dc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144497, "uuid": "112c5bfc-1583-4308-a466-80d3790681d7", "value": "aea570ebce97855285a28e3e1a091511484201cd7ad4ca9a3a0e5cb8d29ba82b.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2ca73b-af3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761133614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133614, "uuid": "ae3c6f64-1f9e-4e0b-9341-f75772cd323a", "comment": "Malware payload (Mirai)", "value": "b3543afb0b5bff16efca95af4b568be1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133614, "uuid": "e73fe0a8-67ba-48ae-8a76-c1e39a10c969", "comment": "Malware payload (Mirai)", "value": "b0660f87cac0d1b870cc510c4939111a5d6cd08337f72a98efbcac19a462c542", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133614, "uuid": "34db838a-013a-49c4-a6f5-eaffbf3115bf", "comment": "Malware payload (Mirai)", "value": "e0ad27e57e5f49aebd809a21a12e42b623d42d7c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761133614, "uuid": "419b014e-0823-4da1-96b5-b84228d65e9f", "comment": "Malware payload (Mirai)", "value": "9e34d4d704c694b09c2e08c38a908044acbb18faeaa6c971838d49650d9f4ae30f4ff8afafc2b73dd4a6c281a5df030c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133614, "uuid": "70770b84-fa3b-4b1f-9da7-e4d77fad036a", "value": "T11E21F49E42C00379A440FA2A72C3892EE89576D626F00E5CEA4D24B17B5CBC4F81CF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133614, "uuid": "259641a9-b4de-4865-9395-1ed5a9b86584", "value": "24:ToWBGhBh9Mk8QozZAyk/fk/rk/Ga3k/dfk/Hk/3k/Y:ToGGhL8QozZAyk/fk/rk/9k/Fk/Hk/3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761133614, "uuid": "b38fd748-9633-43db-bc25-df97346c7d7c", "value": 1441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761133614, "uuid": "f0ae88a2-da41-4c0c-bd88-dc512e09d9a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761133614, "uuid": "c999d617-f34d-48ce-a0c3-492f9df480be", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fc66d7-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload (GhostSocks)", "timestamp": 1761137361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137361, "uuid": "dfeb629d-172f-4ebb-8f96-0a226c9a3264", "comment": "Malware payload (GhostSocks)", "value": "e6674761c4507388b93bc1c3c272d9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137361, "uuid": "6f6d9910-a6f2-49ac-a79a-79f865807062", "comment": "Malware payload (GhostSocks)", "value": "b1bb7b501a17e261becfea6938a4e3fad559210b10f8913ac49ed04439da7a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137361, "uuid": "36b8bf84-8e45-460e-9339-844501453570", "comment": "Malware payload (GhostSocks)", "value": "16f5826235e901df527f332559aa9d572d17fe7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137361, "uuid": "aa802ec0-c21d-4a8b-9b83-60727736619d", "comment": "Malware payload (GhostSocks)", "value": "c5b0ca902d8b5a025de594e2d6e05202304ae0f781e57a1546e177c50cdfdd1fd6bb773a2940b66afc7e064f1821eb94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137361, "uuid": "817b6465-03e1-4093-bdc6-f53dd93795fe", "value": "T12846232053E26540DAA86BBE95B3520CE83C7C160676DB179E08DE3F4A73983BD4D35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137361, "uuid": "7f0e9a25-ea6c-4f67-b998-e2644a04c83a", "value": "5f52ecc257077cdbb836d125526712fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137361, "uuid": "72413d06-6a1f-41e5-a7ce-a3e8b4e8c677", "value": "98304:ZuQz8PASPD3GEVNsMv6YhyAg0WGmwoPllwTOrTVP0fNIWKLn5KP+sfFEyS:ZHQoSr3HXFv6Y7APUTqTx0NIWKn3gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137361, "uuid": "4850055e-7a31-4ffd-85d4-2c2d9fe2c723", "value": 5528104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137361, "uuid": "2d6fa69c-f3c2-4bae-9628-368235f5e62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137361, "uuid": "16e91c8f-4a9d-42b2-b408-a143dcd2f5c6", "value": "Renewable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88feca13-af22-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761122331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122331, "uuid": "a56a7115-77e6-4806-aee8-5a09ce90b689", "comment": "Malware payload (Formbook)", "value": "4bfadec1a00cceecd1e15ef1de185133", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122331, "uuid": "4aadc415-6f33-4977-91d8-e6858d5c2758", "comment": "Malware payload (Formbook)", "value": "b25b8ca9c790e8030383a0e15562726076f420e38976d4f0b5dadc6ddce2debd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122331, "uuid": "5632d764-f076-49d9-9f9a-6ceeca824f15", "comment": "Malware payload (Formbook)", "value": "28c93330141efda43d4ef9bb4afd5202c697d039", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761122331, "uuid": "924b5583-62f8-4b98-88d9-ccca52de389b", "comment": "Malware payload (Formbook)", "value": "ed9c0131945de5cdbe02a6c8cb30146dc3d32e606178e50112246b48421e32589c59fcdcb89cb1174766e00ad8358ffe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122331, "uuid": "72bfb339-5905-4edf-85c3-7a9e1235b7cf", "value": "T17FA5AEB28CB75EC92F7824CAC5DE7AC43F1C47538528A6906A4FB27F21595017EDC8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122331, "uuid": "c87e05e5-6d94-47f8-a26e-d778a364105d", "value": "49152:bSe5PoR/ewnHSRvxDh3iE8gLYAVGIrE+Ha+k:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761122331, "uuid": "18121019-0ccb-4a3e-bbea-d81cbcb0b7e5", "value": 2188987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761122331, "uuid": "4e1c1955-748d-427d-9555-cd139aff29cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761122331, "uuid": "f143daa3-85f8-4e5e-8096-1a2c21b30c71", "value": "34435677825.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71b9166-af1e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120770, "uuid": "64412d26-d75f-4600-a298-7aa55d4091d4", "comment": "Malware payload (Mirai)", "value": "0b5d140cc1dfc3531e66ec14d6214b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120770, "uuid": "a18cdc92-b27e-451c-b4d4-9b804f22ecb5", "comment": "Malware payload (Mirai)", "value": "b2792ebc487a8605cb9119e3c9c0e7547baf78bbb5ef1533c45f3c3fcc6b0605", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120770, "uuid": "d684a4d6-39f0-4752-bcd0-b8825849331d", "comment": "Malware payload (Mirai)", "value": "f8c85f35fdf8f25e4d8bf8fe1a5350215b6708be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120770, "uuid": "40ed0256-2aed-4817-aab0-3506fab5e26f", "comment": "Malware payload (Mirai)", "value": "8e595e90781877d85410c29c9ad5b2e449922ce3bfdb0eb58e33fb115fa33059eeb9fa854ba18c65b5e7fcbca7ed8c97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120770, "uuid": "cf2ea514-e6bc-4f3a-bc51-7313597f5c81", "value": "T1676302FA85D28853C566DD7C9CC9A90A4A8842F026AC7453711EC188AEF34879FE9C97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120770, "uuid": "25cc7fdf-6ddc-486f-8a45-12d7da120da1", "value": "1536:5Ya+1S4DXSEMkxhuL8YaGwiWsQvRHpqsSZQElLfLytNIe4fAsSDD2:5YOiMkmLbGsQZn9ElrLyzIeUAf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120770, "uuid": "be658cf8-bd4e-4315-9177-93489d6432c6", "value": 71320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120770, "uuid": "6354019d-bfb3-4df9-8cdd-9cbad386d4fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120770, "uuid": "20a7ff4e-5f86-4cab-9990-f9faed9f0a7d", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620d9a22-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137727, "uuid": "7762dea1-b163-4ef5-b292-404da0c0fe69", "comment": "Malware payload", "value": "bc21aa1917e086be1c85aaba443922df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137727, "uuid": "c3371edd-e02e-4568-8e91-a7f04d976c7a", "comment": "Malware payload", "value": "b2b7969521f4513a7a34965cbacac4cd7fa3a1ac58b832676af3f6dcab73da47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137727, "uuid": "02397503-4a3d-476d-b946-5d8243f4241d", "comment": "Malware payload", "value": "b044a353b1e627d242966eb4f4f309bde1340a8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137727, "uuid": "379085d6-adeb-42ee-9cf7-988ca661c093", "comment": "Malware payload", "value": "846963a42202b78be3b6d7ae3afd5cd9d7554cdeebc19fd45adfbd74317a188abde9afe9e36cff5b58fe4ffdae6ef57d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137727, "uuid": "2e3f52f1-f806-4814-9d96-bdd74f358dfb", "value": "T1C72621414ABFDE1805104D98BE8554E8FB3A784F0B1B506E7844F8E8D793E17EA98B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137727, "uuid": "12268d17-0023-4e70-a800-10f502b8cb1c", "value": "768:kpNXa/tGIkb4drfAjjMdbpVn8RV+U9rv7IAqMAG89mPfTWpeFnI7LIbpuE24nbr1:ItaIb0Lq+UVvkErWpeBbpuEdki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137727, "uuid": "4fe10d73-bc38-4873-94cd-586b51473133", "value": 4510143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137727, "uuid": "ec504219-4a0b-4104-8486-155f8e9fb66c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137727, "uuid": "34375899-3e99-4e24-a404-3711e1530672", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f099cf6-af98-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761172807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172807, "uuid": "9ef096dc-43f4-4692-b4e1-ac48f08bcae0", "comment": "Malware payload (ValleyRAT)", "value": "832ff44edf6b9ba921b9dac9c4fd2271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172807, "uuid": "7ff57a22-7b64-493e-8218-fbd99297e185", "comment": "Malware payload (ValleyRAT)", "value": "b32f43b67ea3f6758d18f671d2b69b80e267b78b2c72b452b1147f7ab6a06e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172807, "uuid": "4366127c-cd00-448d-95aa-cac4f2ad042b", "comment": "Malware payload (ValleyRAT)", "value": "471698e4ebab0798a166c6067c7b23205563102e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172807, "uuid": "9045529c-9dd8-4450-851b-2f3f69763007", "comment": "Malware payload (ValleyRAT)", "value": "0ac5d55f326ec45dabba5d50204b75afb7521e488dc376a9887507e71b8f0f5d889177d3eb90203ae27805134836eaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172807, "uuid": "2e78bb16-0eb4-4ad7-b38a-842e80ab7df6", "value": "T104B37B2172A0C072C093253199F9EBB24E7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172807, "uuid": "b07026cf-c86b-4797-a682-9a8843901ebe", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172807, "uuid": "92d5c2dd-10cf-4ce4-9b83-04518717fb22", "value": "3072:qbWjdIPbcia0NFtwwnILn3py6D268XEPKs2:qbWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172807, "uuid": "d74fc12c-12d2-4058-9f47-bb9e2c932497", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172807, "uuid": "35194502-958a-41f4-a682-78fd6841bded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172807, "uuid": "e4433747-78ef-4f52-b871-bb402308d844", "value": "b32f43b67ea3f6758d18f671d2b69b80e267b78b2c72b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152b2ca4-af91-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761169810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169810, "uuid": "ecac5efc-5b7b-41af-8f8c-b0aa90c0b901", "comment": "Malware payload (XWorm)", "value": "185f04ed32e0fa90703c686b7444c168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169810, "uuid": "405f3165-67f4-4f4e-894a-f74a7f7e99ee", "comment": "Malware payload (XWorm)", "value": "b583337dc4ace9e19460ccfcb28ac6631d5c4bd953b455871bfb5bb97a69fb5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169810, "uuid": "2dc22c87-5af4-4163-8197-7787e044c46b", "comment": "Malware payload (XWorm)", "value": "d58b5fc37b286b2bcbdae7dbb2b118ec064da134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169810, "uuid": "13ad1ee9-2ce5-4048-8d6c-e127ed2dbd73", "comment": "Malware payload (XWorm)", "value": "abc947e92542c62496c2438f86c2bbfc4b0acc57ed119f81864f847503cc5e787a72ab30a7839689f3f927f655f06d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169810, "uuid": "95b2ce4c-73ae-449c-adb2-97dc3c93d685", "value": "T145F5335A43085F4EC81B277ADCD4EB3636B44EC4EB90E11511F08C27F05DABBAEA99D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169810, "uuid": "2874e031-1a3f-49aa-b989-ac80c555eea6", "value": "56c36b85d55a45997faebf6eaeecf9b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169810, "uuid": "2de6630f-87e9-46c4-a091-b1f7deb82f7a", "value": "98304:82CW6LZyQAaD6J2wYbJB148QkeetUn6IeTxJbAl1K:82f6iNObOkeeqWbAl1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761169810, "uuid": "81268229-3b8d-4aa2-a279-c6ff52fd73dc", "value": 3522048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761169810, "uuid": "a01f545d-3437-46ae-a16c-728c44e292cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169810, "uuid": "6a152424-6e3c-4a27-ba20-a5b0f833c438", "value": "AkaiProxyv1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b811b-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1761113263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113263, "uuid": "c504caa3-3b03-4f5d-bfdd-3a35a8ec5cad", "comment": "Malware payload (ConnectWise)", "value": "0fba92a8d93c7db9f18d34f2b3138397", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113263, "uuid": "f8fe6d00-ff3e-4bb9-8256-1edb5d74c397", "comment": "Malware payload (ConnectWise)", "value": "b5ac2e3e22480fdfb4268d17120be6d45e146e90a55997edf62fc15a60118105", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113263, "uuid": "265d65e1-d2a9-4656-9272-0c3b5dcb576f", "comment": "Malware payload (ConnectWise)", "value": "109e8234b510c8d87306f2945b704b04a97cfcc2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113263, "uuid": "15dd696f-56e6-47b8-8cdb-4f5ffe66de80", "comment": "Malware payload (ConnectWise)", "value": "6519f70acf5ac930f6657e6fbb44f294b45f34088b87ff9f97b9bdf2c0426ac843028fc400665fa46afd7bdc6d479cd8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113263, "uuid": "f49ad750-e688-4153-be19-991ca21ae2dd", "value": "T1E6650120B6E5883DEAF61A36FF7A92615F39FD251B20C15E8394390D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113263, "uuid": "65e7c245-1199-4d8c-8991-c0e37f6fb66d", "value": "24576:zZPlmF0uwTKh56Z5vePu/DVeL1pVjeOznUUGGu/aYmQurhwQUv:Tmh69eWbVypVCygGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113263, "uuid": "a81787ca-b2d1-48fe-a535-76f8aedc11fa", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113263, "uuid": "781e88e4-a0a1-4428-a97a-dcc51c653c3b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113263, "uuid": "3713de83-484e-4048-917b-519fb610a69e", "value": "b5ac2e3e22480fdfb4268d17120be6d45e146e90a55997edf62fc15a60118105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345aa8f1-af98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172869, "uuid": "d6ed2e7f-b803-440d-965b-d64ed6c329f3", "comment": "Malware payload (Mirai)", "value": "502fc021d84a3588622d36d94ac4712c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172869, "uuid": "b7fe2fbb-80b0-475f-9198-cb3e5a91bfed", "comment": "Malware payload (Mirai)", "value": "b74b13809596faf96c9a9ef7a5d1edf56b9c4810698ebf8678d68dc5a2158b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172869, "uuid": "a1cf1f6c-0ee3-4243-8818-c2fd63e5fefb", "comment": "Malware payload (Mirai)", "value": "4ce5dbf9525599d0339f243b365703fb3399bc88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172869, "uuid": "ba56728f-6c6d-4daa-a113-580ad5d483e3", "comment": "Malware payload (Mirai)", "value": "5face25925c73e2391db3141e8f46a85afc017f5528c082b2d8fa8f317464c22298df9a29616271ff9abd8f0dda01da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172869, "uuid": "93884d23-e611-4a99-84b3-1dfc2a7074bc", "value": "T11573E652BC828A2AC5E112BAB57E918D372163FAD2CF7117CC610F507B8641F1AA3FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172869, "uuid": "d8f42607-bdb3-4642-aa6f-c2b8041ee3c8", "value": "1536:z9vTZIhqkFSAMWipTENcKtd0yIId4cONSLkYdgKK+1gAg2mG6CFLw/ZMydhQzqlW:z9vTZIhqadbZA2mG5i/ZMydhQzqljK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172869, "uuid": "e0e45cad-002b-4330-83a1-a61fd2b24de1", "value": 75480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172869, "uuid": "9b855e4d-8a0b-4bc2-849e-aac3e696fc99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172869, "uuid": "9ef150d8-70bd-44f8-9438-3d355a584791", "value": "kwari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243399f-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173295, "uuid": "e6f704ef-f7d0-406e-95af-b86470ddc174", "comment": "Malware payload (Mirai)", "value": "7a4e4fa405e6f0ba0dafb8dc7c45c857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173295, "uuid": "b308dcee-95e4-4291-8786-b0c41f49886e", "comment": "Malware payload (Mirai)", "value": "b80c88fb66f19d683da92660c17a0ed09576670688a74e40dd289ce8b33867c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173295, "uuid": "9fcb59eb-68ab-415e-8b59-bb1165484484", "comment": "Malware payload (Mirai)", "value": "2554827f2d0ea5805f47e8640fedd0b93a67565a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173295, "uuid": "6900918d-e20a-4157-9ba1-cf85e0cc55f0", "comment": "Malware payload (Mirai)", "value": "58f2443d15f0744008dc3f92555bc4ab55001b22e1bfb3e0b00fb51c9da7635b8e9d1c1e389afc2235db6442f491afdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173295, "uuid": "8ac89327-1ad1-4336-990a-a7dc913e01c5", "value": "T121D3F745B881AB20D6C625BBFE4F518A33135BACE3EE7213DD141F2427CA94B0F7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173295, "uuid": "1eff2729-8a57-4457-822b-c22017511e04", "value": "3072:dpGS5f3hNxctoZw+uuMMv+UrVRx7k7353aCXDWzd+z6PQ4LD09/eDnzP:dpGkf3tctoZw+uufv+UfxY7p3aCXDWzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173295, "uuid": "44b81562-65e9-4f6e-bbc9-c44d31f33472", "value": 132592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173295, "uuid": "e69173d8-15f0-4412-894e-90169ca12823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173295, "uuid": "d52d2a13-fe1b-4533-bf2e-08324ed1c7e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d4aadc-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761134865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134865, "uuid": "06a14d7d-80e7-488a-8ca4-5da6517107af", "comment": "Malware payload (Rhadamanthys)", "value": "deb15a2db9ba01a54b0e91b36d89028c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134865, "uuid": "691f51bc-5c60-452a-b86a-8b1e1eb40c30", "comment": "Malware payload (Rhadamanthys)", "value": "b829b8857eda796413908642bda6186d9cb7df4e5e70afb1b68e71d0e660bbdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134865, "uuid": "899bc75b-5cdf-4a4d-a5df-4718a2a9be87", "comment": "Malware payload (Rhadamanthys)", "value": "c95c41bd489d7bc52cdea791a58f7951f447f956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134865, "uuid": "fc9946d8-1952-4770-9804-5c627f98852e", "comment": "Malware payload (Rhadamanthys)", "value": "4ac108081b5f74d716bb23bdb7eb961cf637d34cf5e7b54b3a557efe0cbcae6eab08dd21b6e1d13e00099b61f88baff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134865, "uuid": "23c8b3da-8140-40f3-9abc-3e258c920939", "value": "T15C753361BDE45075ED8423FC38FF557F1130F4948BAE94CBA648D8AE52804C6227B7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134865, "uuid": "f1a71932-bd14-4942-b1e1-aec512b9eb4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134865, "uuid": "0cabed6b-534d-4aff-b9b9-cacd7f53a5b8", "value": "24576:JIlzSycpmH3c6sjAC1ZVm3lbGvqKL2s5usdHQQks0/Si7bcKUKlwbtlZquYxMrfQ:2lFH3aUiA9KLdFTRniPct3lZJYx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134865, "uuid": "042ac2e2-0c3c-48d7-8f7a-fbbaed0dba43", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134865, "uuid": "9767d084-debd-49e8-98d6-b67e57e1f3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134865, "uuid": "551687d0-f9ad-4793-b4c6-8e042af6d156", "value": "deb15a2db9ba01a54b0e91b36d89028c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4735e39d-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150567, "uuid": "b0f84ea9-51e2-42e1-ab7d-a235accdf77b", "comment": "Malware payload (Rhadamanthys)", "value": "207c67e9d3cd4c06f5449fdd58808f4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150567, "uuid": "ba1abe4e-0924-41fd-acab-bd7ffe03ddb3", "comment": "Malware payload (Rhadamanthys)", "value": "b8682cfe541ea3fbbd906b715d53c1309675aebc883dc7d23ab56d0d7197698b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150567, "uuid": "17a98743-e3e6-49ce-8ff9-3a6e93ac9f85", "comment": "Malware payload (Rhadamanthys)", "value": "cde0b9c4cf2823caf828469b90e2b11342f1cd9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150567, "uuid": "00218acd-3b7f-47e4-a727-0b59d885de6c", "comment": "Malware payload (Rhadamanthys)", "value": "54c8ad4e61bf922242ee231274fb8a09c378a07dae89998768b537c7aa21e294587c75bcb0f40f76c140d0017d97e084", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150567, "uuid": "2c35ebf0-6f3d-4739-a7c0-17a4ae8ab663", "value": "T165B3082B8D72EDBC05E67B5ABF40A0FF951D61CE920B78F1615FB0B1488CE64591A0CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150567, "uuid": "5175d7b7-a435-46af-ae09-c52e50a3fc5f", "value": "1536:GDB7eKg202TbK8D0wYpl5v22oTbjkArnz3dn0olGbW41068ZLscC5cCO5cTTw3pS:GDB7b0tYGHkmQG0M60mflE5wX6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150567, "uuid": "fbca6f3a-70b7-4282-b264-5c64d1e95419", "value": 108052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150567, "uuid": "ec6881c4-d13a-49f5-8291-21f0c847d1fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150567, "uuid": "c228f92d-c203-446a-81c9-409a37eb61ba", "value": "invoice-1637482117.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bacac0-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120829, "uuid": "4069504c-baeb-48ea-8151-ac9567df3d3c", "comment": "Malware payload (Mirai)", "value": "c4243bc3fdbfef58b35a03e346121ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120829, "uuid": "16f772b9-ce39-45f6-818e-1ea8d3b77cf6", "comment": "Malware payload (Mirai)", "value": "b99b79375d33b14ee0209146fa3009b591af24eb9ce6561a2e5dba6a2bb43bf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120829, "uuid": "58094970-972f-4aaa-84e5-4005a91360ca", "comment": "Malware payload (Mirai)", "value": "67f2db287da1598eddf029ed2371eaa3600e56a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120829, "uuid": "fd428aef-d07f-4af2-b045-245a027c93f5", "comment": "Malware payload (Mirai)", "value": "c07a1c486605acb832799181ed94fa989abaec50b3c4bb234aecab9011d8cb8aae4abe132a29bc08f5d94a228bf5052e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120829, "uuid": "72f5fb93-fc8d-46d4-9283-13071eddbee2", "value": "T121142B46EA414A13C0D727B9B6AF4246333397A4E3DB330699286FF43F8675E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120829, "uuid": "4c186731-cf02-4c72-8dfc-b921b829b163", "value": "3072:GM0MMPFrwNP+HawSETg1Eru7U1xCThg0pO93NOpM/9izXsys:GM0MM02HawSETg1Ku7GClgYO93NMM/9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120829, "uuid": "6c181925-1b3c-481c-8ae5-0bd999d138c6", "value": 196025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120829, "uuid": "c0accbd1-1361-45f1-adbc-80b5b9ef1849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120829, "uuid": "b88ef1b6-1565-4bea-bf31-ebc9f6e68a7b", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc297280-af48-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138737, "uuid": "199e2aaf-e1d0-443e-888c-6d739d62512a", "comment": "Malware payload", "value": "f9885c68c3e5cc834fb8c484de34bf42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138737, "uuid": "f6a61df9-aec2-4b68-a1cc-2d13cc9c6e5b", "comment": "Malware payload", "value": "b9e6a8dee43bbac10df0f5a00b46ba95f3379ad4ad9ebcec9239ab072df58493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138737, "uuid": "aae81fe0-38d8-4970-8344-c1f852303117", "comment": "Malware payload", "value": "e97d80cb515af3bb2abc6848662097890c7ddc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138737, "uuid": "fd048106-8856-4fb9-a9c1-b396f13fe86a", "comment": "Malware payload", "value": "97b755db083c201d8fbc2170e505069a06b2f3f1cc2e287a65ab3b73c1f1af9e12bd4d5996569f5a6add6ffd84d612cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138737, "uuid": "4a765dd7-9f62-4498-8cd5-1699fb75ac49", "value": "T15C545C59B3A90CF8E8B7923DC9524906E6B2BC160760DBDF03A046672F276D19D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138737, "uuid": "6b06a67a-f73b-4802-b590-8fbf6d8974de", "value": "9960a50ef04e2ef3c4598974105253b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138737, "uuid": "af717697-3cef-4593-affb-cd8293299f4a", "value": "3072:BGNDMjBCybHEpCUpiyzJ3fUelvdb0TG9UuIMn3R/ZLEJbBNaDG3SHM6qR354T/tT:BG2VCTpCyVf5vdbX73Rx0bB0325Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138737, "uuid": "4ad49195-0e59-4d92-99b5-88a2a48db7cd", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138737, "uuid": "62c4cd70-01aa-4fb9-a344-f266899e2633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138737, "uuid": "5de58dc9-c72c-4090-a60e-f1ee80b3604a", "value": "pocs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f664609-af0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761114047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114047, "uuid": "12d90c56-d283-4f35-9fe9-61ffa6e8ed61", "comment": "Malware payload (MassLogger)", "value": "a70e3596486fabe206976a5b2283a455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114047, "uuid": "a8b3fbca-a5d0-4d95-a04e-a0eca29ae54b", "comment": "Malware payload (MassLogger)", "value": "baa4644728c7e2bb52305701569700be80e76adf9a50bdca2faa54eed64cfc9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114047, "uuid": "bb74c045-26dd-4584-b7b5-2a8a3b6afa53", "comment": "Malware payload (MassLogger)", "value": "767d665337dc80321e871d7eff7238d6e80c05be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761114047, "uuid": "24ca426c-1028-47e1-a252-e66159b05ba6", "comment": "Malware payload (MassLogger)", "value": "d08445f7b00c72922146c0ee64b7781271d6cc9b606d54c7d0a730d0dd47256c473aa4d5fdc41a7a7b3183edc63bd04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114047, "uuid": "53b8558e-318e-4d65-9f41-f3d09f1ff3d1", "value": "T1E6A412812929C723C9974BF84975E070B3B87E996911DA059EEB3CEF7839B401B15B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114047, "uuid": "116f189a-5cee-4d09-911a-b0849d8886f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114047, "uuid": "78a4fff1-d4e5-494d-85f6-488a01f8fc24", "value": "12288:1+gXfGhJHQ9s0KwogZ/LxrLXA4RZ+q8hs/6F1w:cgOhJqVZ/LlXAAZtv6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761114047, "uuid": "a0aa8bc0-0dde-4066-ac54-550fb323572a", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761114047, "uuid": "e0f62196-038e-4af3-b912-7c7298f68d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761114047, "uuid": "7722a4ad-4770-446b-82e6-a64ac7f6ae6e", "value": "New Order..pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa3580-af2d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761127002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127002, "uuid": "c73c3aa7-ff64-4463-8141-3b1996d31a91", "comment": "Malware payload (Mirai)", "value": "6939b60975f4632aebbd2e12ac4547bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127002, "uuid": "1c8352b7-b25a-4994-b839-e6a0f19a4243", "comment": "Malware payload (Mirai)", "value": "bc093861ec2326bb5e0b033f0ab23ebdcfe74a9ca17d9beee129038985a3ea93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127002, "uuid": "834cdfe1-8a88-4e4f-921b-51eb4c3d10ec", "comment": "Malware payload (Mirai)", "value": "adb93781b5c782c0d0c834e4b2bb3c4a8914bde2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127002, "uuid": "4f08721a-4001-4574-b018-7f20bd218633", "comment": "Malware payload (Mirai)", "value": "4efa3dd8acf5755f4860b7f3bf77c1993658aa82cb89688e081f838642fd21c6b5585b615a72b4ae535041c7821730ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127002, "uuid": "face16a7-f083-41bb-a55b-52c3184f3065", "value": "T14C04E816AB550FFBDCABCD3702E90B1139CCA54B22A43B363674D528F55E50B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127002, "uuid": "11bb9bde-a783-4e9c-8012-a286a827cced", "value": "1536:voltIeuJRG2ltBg1tLaEwQqGmHC6ExJQhG1zTmbUc6Z6ZchA1ckx7xVTpI0k+iL9:vStIHG8qoQqOCbN6ARx7PTHk+JKoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761127002, "uuid": "4e6517bd-5548-4773-b6bb-8cc9b14943e5", "value": 177764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761127002, "uuid": "795396ad-3f8b-4428-9400-225fc74e8e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127002, "uuid": "800cc12e-d81f-48a5-9737-6797d286f579", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01df357b-af2e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761127258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127258, "uuid": "52633b5a-b7e8-4c2f-8489-2e50fb82a623", "comment": "Malware payload (Mirai)", "value": "d09f7f763eac28eb9334d6c42aa76ee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127258, "uuid": "7f4a8234-fb39-4803-b9b0-873973dc4d7d", "comment": "Malware payload (Mirai)", "value": "bd0ead1cf55fb92b3ce7049e256be085a9e94f6a13f33f380e172e2b6bd880fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127258, "uuid": "c32aa0d8-b8dd-447e-af6d-dc3cf5ec1e56", "comment": "Malware payload (Mirai)", "value": "b224bbd437903b13d97fb36e3fa71759887cf196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761127258, "uuid": "96a86e53-4508-4263-b725-e212bc4ea749", "comment": "Malware payload (Mirai)", "value": "80245b40e94572f87510f755acaa92feb9b274e2b89a96c61e4698eb7fc5584d655c5bd9cbe6357e32bb022033c231e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127258, "uuid": "172ae592-f354-46f0-a332-aff80aafb7c0", "value": "T1FBE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127258, "uuid": "1842377b-e625-46f9-abc0-3cfa22a27c6a", "value": "3072:GmhTDH80JE78Lq5lZjApqGidS8w9aeVvjbieL/VCyIOH8Pk:GETDH80JYPjApq3du9a4LcyIrPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761127258, "uuid": "b8bfd995-18af-4e8d-8d39-4f3c26e34883", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761127258, "uuid": "c27c0cd6-cc53-4af4-b53b-b47f427acfe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761127258, "uuid": "83f16737-32ad-4215-a95d-750565c9252b", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc4d6e2-af37-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761131462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131462, "uuid": "5688cdca-3ef8-4a4a-b558-300fc667f7b9", "comment": "Malware payload (RemcosRAT)", "value": "2eeaca5c8494a54ad869971d2aa182ee", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131462, "uuid": "d8056c8a-75f8-42f4-ba17-37c43099627e", "comment": "Malware payload (RemcosRAT)", "value": "bda01916b6f531779cc4e14b3a45648615088a7e8d62ef900d35fbdbd0cbbb59", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131462, "uuid": "d13018c8-4b0d-4ca4-aaca-ae1f062824bb", "comment": "Malware payload (RemcosRAT)", "value": "e24dcd2d05e3ff964ed848f7a78079d1892fa61c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131462, "uuid": "e2903d5f-3d59-4f36-a5b0-aef3e9390d25", "comment": "Malware payload (RemcosRAT)", "value": "81861670c06b3fc6a934e3adb9bf4697994317debdae6b989af7141ea214346a1d5275cd259f3cc4a4822e0f08b101ae", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131462, "uuid": "3fc41e71-dd6b-4891-bc6c-e19bf82d23c0", "value": "T1B0C5CF5D94B05D825024FE74AAC5F793CCEA17851A274B920FE5E2A67202C43FF7B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131462, "uuid": "875bd2d4-1b05-4d20-9be9-016cb296a9aa", "value": "24576:6rwe5535Ve70s1J/OcG/NZUeLr4jpISZealIuoc6IUWQ4RB:4LJrofeSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131462, "uuid": "8adfda4c-2d35-4632-a2f9-bb6276fa3b5e", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131462, "uuid": "66fb6441-baa3-46d9-bfec-637e716624dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131462, "uuid": "c0025a87-498e-47f4-a903-715a37e7ddcd", "value": "sdo0xc9vwhwr0sd09cvxcv9fsd0wejbxncbv320sdcx89xc0cvs9d3jh4jd0fs9df0.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b745d758-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138300, "uuid": "71f47bed-1e44-4a08-9bee-9d5667fe4e8c", "comment": "Malware payload", "value": "c2d091c087448f852d04b7f2241ff058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138300, "uuid": "fb440be8-27f5-4d48-85cc-9cf92aec38fd", "comment": "Malware payload", "value": "be4d77deeba3a0a6320cd970d3cc1988f3afdd021cb1c65b5c6d89bdeb40e7a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138300, "uuid": "3ec4ef45-ec84-45fb-9596-08af30e91eb6", "comment": "Malware payload", "value": "1a77880d52a86024a43176d9f681b4a26ce19117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138300, "uuid": "c2cc4499-c3ee-456f-a34e-279decdc2f00", "comment": "Malware payload", "value": "f5158037cbb0c500df6b06a04b00d6a8677e45db46f4cc771c67b9ec57d621e17fd55b8c58a311dacfbdab5e63e7e567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138300, "uuid": "5a80614a-f23e-4831-9d29-e8c35abd4261", "value": "T1DCF412296B6FDD03D4D46BB10AB1F37261385E09E920E2168FFDBCCB74A9B16285D341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138300, "uuid": "422f2080-caaf-4702-a934-aa40449f72c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138300, "uuid": "c7619dad-19f6-4c44-9268-dd74cfd44345", "value": "12288:CYE6KUngBY8aQ9YrbQORkC5nlpLoBXRvvJ7xf39Tez7DMkuPxxWoQP693FrDXTys:CYKWgyY9YAONaBXxa7DMpxWoQu3FfTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138300, "uuid": "40453024-cc4c-4ddf-a004-40e75d66db3d", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138300, "uuid": "b971d036-8d13-4a85-9693-99abbca2d6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138300, "uuid": "28da1577-1a1a-4691-9a55-407f406a3c05", "value": "YEN\u0130 S\u0130PAR\u0130\u015e Empo Otomotiv Yedek Par\u00e7a San O20250003984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a317e93e-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761138266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138266, "uuid": "d490ab7a-1248-483e-9673-a1b519f78038", "comment": "Malware payload (GuLoader)", "value": "5f2c20ba62ad50901610b5c9840ffcaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138266, "uuid": "ec995fe1-241b-4ae5-aeae-0ac616a5b582", "comment": "Malware payload (GuLoader)", "value": "beecd658bfb84b9c4be5988df3743d231c405bc7ef8dce0a0eb5bbce668c7760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138266, "uuid": "01332f16-2a36-4857-812a-12a9c7a4d743", "comment": "Malware payload (GuLoader)", "value": "f0250ebcc2028a33213273a8c4c8c0550efb491c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138266, "uuid": "7a25f8a5-e190-4963-97fe-7e3e33937a4c", "comment": "Malware payload (GuLoader)", "value": "9663c280dd7da2936171832027a9e2d39eb18274ccfe7380914d4051bc558aab7fb336a11781003909b46f141f0b5a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138266, "uuid": "e3da9a9d-c224-4b47-b79a-765a3270c33c", "value": "T1D8942307676AF427E1F65B702875EA3758A9C63E45A8A703631879C87D33B81DF0F242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138266, "uuid": "5959792d-dbb8-4675-8dae-61bda9b77249", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138266, "uuid": "ba49181d-b9db-4711-9cc7-27d279ebfbfc", "value": "6144:Shgqhw9oAsqdBsAWZzhhkgK5MseZmSYF3ONdPrXevfHrR/VWyUdVPSHf8Gik9mJk:xqfqfIbhz7JBrqfHrRtWTYEVinc/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138266, "uuid": "93c4d453-6cd8-40f6-96c1-62d5f2668b5b", "value": 432928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138266, "uuid": "69fe1915-5959-4e04-85c1-988a622aebaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138266, "uuid": "8d0c2ce7-4216-4ece-8a4d-0ae14bd9d59e", "value": "HSBC_PAYMENT_ADVICE_100212025_REFP3200B-20250813-024142914208136738390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf27bb7-af07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761110872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110872, "uuid": "dad64e52-b941-4609-a0b8-5360503b2a18", "comment": "Malware payload (Mirai)", "value": "7c3863d07f22892e78bf00d1b3291e51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110872, "uuid": "2f5fe26e-4c02-48d0-a1b9-75f7ec90b161", "comment": "Malware payload (Mirai)", "value": "bffa5641d76a3cce5d3bcc235f752be470a933a4e2760cc824811aecdca98ab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110872, "uuid": "b35b9b13-4ce3-4a01-824f-c020324aa715", "comment": "Malware payload (Mirai)", "value": "b0fda15e7c3e2f28e3796a5a41dba2c00d96f609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110872, "uuid": "aa69b588-fd3d-4793-a066-c9613ba3333b", "comment": "Malware payload (Mirai)", "value": "a7c916dd4b28ffab627bc68bd007feba033bc0c6574e0a5460eaac4d357cf930cfb3175f0ec9f5a47e333c361b2f401f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110872, "uuid": "1b211e4f-06b1-4607-b7aa-ba5df51b3807", "value": "T1D9A3B516BF610FB7D85BCC770AE92B01188C691B25A93B72B934DC54B61B29F15E3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110872, "uuid": "6b7ceece-3b5f-423f-9fba-b4b74694e1fb", "value": "1536:omF3k7HZK6irjYJktGkSCvKJh6VWoZPCk8idhQz2y5:omF3MHZKkCYk/WoJdhQz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761110872, "uuid": "3b01f62c-02cd-486f-9909-4ef2041b354a", "value": 98688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761110872, "uuid": "14461598-2faf-425c-9bec-2f39f41da9fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110872, "uuid": "d4dff9b5-eec0-4d62-9eea-4c74664a79c6", "value": "kwari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a6a87a-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150611, "uuid": "714f6c46-027d-4e2d-8b84-7a9426910436", "comment": "Malware payload (Rhadamanthys)", "value": "7fc06dae10d3703ba6f66917ec1fc0a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150611, "uuid": "8144cf35-c664-42ce-91c4-27cc386de622", "comment": "Malware payload (Rhadamanthys)", "value": "c0ad162eaf6ed2270965ed5c17bcfc8f02987a5a36508db1407e241c7f2f9cc5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150611, "uuid": "d356e95b-8066-414b-b350-29299e82c034", "comment": "Malware payload (Rhadamanthys)", "value": "3c7baf0c331419eb057bf0df7d8d34dbac7ebca3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150611, "uuid": "35a210dd-b199-4dd2-8cc3-fafe61f32483", "comment": "Malware payload (Rhadamanthys)", "value": "211462f84b48a5be47080a349d0ef831cab2c0fadb251c7ed8b8228ce5a63a7aadb12bd449ba3882986d41526741e4d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150611, "uuid": "bc38b8bd-cf0d-4efa-9726-d48eecd711ff", "value": "T18EA32B6E6F769CE3986514336E847CF6CF61C84ADB054BA77A07732013B8E0A579068F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150611, "uuid": "978ecba9-3fea-45f8-803c-0008fd90c225", "value": "768:GDhd0i7J4sYKgY/CMNfWdCHGHdH+H5H4HGHjuHPHQHXHLHvHfHMHfuHUH+H5HqHV:GDB7eKg20drDrvTdEgAdjL6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150611, "uuid": "19e35277-2d4b-4515-85cf-26bd930e4be5", "value": 101428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150611, "uuid": "51cae236-ca92-44d3-9d3e-595ebddf29a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150611, "uuid": "14842143-1714-488b-8f09-71ef3f3d2b6a", "value": "invoice-1637482117.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162c0182-af65-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761150914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150914, "uuid": "879bd565-9a26-4fbc-b1dc-2019305d0864", "comment": "Malware payload", "value": "81ab9e9191fb390abce058fa67c21cb0", "object_relation": "md5", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150914, "uuid": "85e99941-c478-461b-a336-4c729897099a", "comment": "Malware payload", "value": "c13e8ad9f8abc95a2d9d52428408ec8eef28c74b076bfd4ea8e0ec8795d259d9", "object_relation": "sha256", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150914, "uuid": "ca2121d0-81a6-407a-afd1-858ec0666623", "comment": "Malware payload", "value": "cd82715c52d113b101ae2dd8e12e8f9e5262d28f", "object_relation": "sha1", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150914, "uuid": "fb1ee950-9d92-4f5e-b7d2-8f1e22932f9f", "comment": "Malware payload", "value": "9460fd68643a6b27a3f0cd2ab0e0c4371940c5049e647f950c3b005323ca03d6db11fc917a753738dbbe31df1aec02a2", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150914, "uuid": "e8ff2e70-73ac-440d-b86e-010cf9613481", "value": "T187214249D4A2D294DE6163A1D8D9567DC753444D1106DCA8C37C78057931F79CCFE4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150914, "uuid": "1bc15856-6ddf-4516-9dbd-f236ce375501", "value": "24:yr/5a1L93AyrnMyapp/7FTL4nrt0tkSphPgYBFwPdz7B2bINx3VLkicHGuY:U5anQyrDappDtLstglhnPQdz7B2bIHi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150914, "uuid": "d8c85eb7-ffef-4a63-be3e-bee87c1f7904", "value": 1293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150914, "uuid": "e784a588-cecd-429f-a9f2-ea1195abd33e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150914, "uuid": "fbc495b6-f7a7-4bdc-b16f-2bf143ac682c", "value": "c13e8ad9f8abc95a2d9d52428408ec8eef28c74b076bfd4ea8e0ec8795d259d9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bd0087-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150512, "uuid": "41237307-e802-4237-966d-f2e17d104a1c", "comment": "Malware payload (Rhadamanthys)", "value": "7f3a8f0831795634ae77021109b1f864", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150512, "uuid": "2d59ad68-b863-4205-b210-11bd7d130e29", "comment": "Malware payload (Rhadamanthys)", "value": "c1e075674aaa8e332ca319d4aec9e5847acd97d32c87268f866c8c31f3e58f90", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150512, "uuid": "04a6894e-656f-4f56-8716-8003ba7beab2", "comment": "Malware payload (Rhadamanthys)", "value": "1c475beb163eaeb15534a2ebcaad177481ec6ef4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150512, "uuid": "32c48142-4217-4303-84a2-7784fdd5c2ff", "comment": "Malware payload (Rhadamanthys)", "value": "90057aa1c4af0db6d483a7ce0336c308ce30ec262103babb1596ec01e8eb6cf3a6b0cf7967c90c1bcf613a8bf253c190", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150512, "uuid": "20404e76-ed21-47cf-a273-1a8b1d527f84", "value": "T121A32BB99D73E83B2045BB076DC305F56D115EF0CB31226A5421AFF401AAE6D8A19FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150512, "uuid": "ab70c5b3-1353-40e4-8011-98e2315b9f50", "value": "1536:GDB7eKg20YcUr5SmMexsIyUMfNr5wrMVwL2SivPaMo+Dog8IWU1MMCBk17k4lQb8:GDB7b0VHeCQNt6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150512, "uuid": "055a4c4f-0ec8-4a9c-ab19-25680f1c5710", "value": 104117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150512, "uuid": "292e1e4c-3e0a-4d60-8950-72293f4ce8c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150512, "uuid": "f3ea72bf-b24e-4972-926c-17d0f7f83897", "value": "invoice-1637482117.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8ae17c-af74-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761157471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157471, "uuid": "74c15c03-866e-41df-adcc-dd452feeeb7d", "comment": "Malware payload", "value": "80bed5a950d7fc9fc00d58d7e47bce39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157471, "uuid": "6a584c2f-f6ef-4bbb-87ce-c0c77c8c6ac3", "comment": "Malware payload", "value": "c2678098b8fd499035c3df7390c92ab255114273e948279907c5ba8c2423b5f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157471, "uuid": "d457c8e4-dde9-49a2-a22f-55ab0f3303eb", "comment": "Malware payload", "value": "5fee94c5009f3c9c51942565fe9ba5b328c1a53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761157471, "uuid": "7fadbe79-0d71-4cf3-b5a6-1cc1b5d90aac", "comment": "Malware payload", "value": "56744bba8b44c88e656d89f6d8132de0bf582ac2b25edfc6b0a1a3108410d38670348b6ae2538e39bd12dca96d34a077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157471, "uuid": "322cd800-d721-4180-bb60-3aca016aad94", "value": "T1B5057D5AF2B374FCC02BC030435BDB62A935F46511226E7B25C4EA392D66E701B29F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157471, "uuid": "cb936afd-10c3-4c17-9ed3-d5ad525703a6", "value": "12288:OwAVpYYjylYdh3nbjk2V0ctQkytmyFzqpZP05k:OwQp/jyqh3nbjJVhtczyZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761157471, "uuid": "5cee73a0-7658-497f-b326-67fa5f095f7f", "value": 840144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761157471, "uuid": "60dbe827-c970-4ebc-a5a3-3d1b65567209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761157471, "uuid": "7bcbeaca-5ced-42b4-a2b9-583ee327bc16", "value": "x86_64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275612a2-af96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761171988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171988, "uuid": "a84881e9-771a-4de9-b266-9868d2ab9ccf", "comment": "Malware payload (Mirai)", "value": "258c23d37537b70517ef8cea372bb8db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171988, "uuid": "7987529d-e8a0-485c-a0bc-12bf50337423", "comment": "Malware payload (Mirai)", "value": "c2e9da160e0393e3dd217788dddd81fc9eedd49955ff6e330ba843e0de90dbba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171988, "uuid": "81a7d38f-bca9-4867-8bae-fd147245c837", "comment": "Malware payload (Mirai)", "value": "0ec7170d507cb7e3bae7c40246ca8bfd9a3e0ef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171988, "uuid": "c34eb11e-6f0c-4659-8574-b76ca657eead", "comment": "Malware payload (Mirai)", "value": "ff9e2e7db34866f29c76afceda5839a6b09cae5fb6809177b67409031e11105aa4f87d6fad3147e1e6e69ca018e73aad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171988, "uuid": "e1ada128-6fa5-4251-9b19-dac83aa3ee79", "value": "T1D443E891F9824667C1D023BAB75E5A8D33A163E4D2CF7657C8204B207B8A94F4D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171988, "uuid": "e7eca270-68d2-4cdc-b880-8bc1798e2e82", "value": "768:rvrFVegVE/XxlQv3Z05MABWjt6hIAUeN0+8dSIheiQxbwdcJ3BdrUAho/rw4Q:Ntq/Xxq3v6htUeN0+85eiHdcJrdBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171988, "uuid": "c1bf60e5-0aa8-4c85-9640-4fd40d6484ab", "value": 56096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171988, "uuid": "a65c809b-819e-4d6d-8d1e-2b26ea15f018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171988, "uuid": "9cc35adc-2670-4ae5-aa23-612f06fd2d3b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851cb2fa-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761121036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121036, "uuid": "fd81da8a-9e81-4c77-a44a-7ef63eea3d9f", "comment": "Malware payload (Mirai)", "value": "b9169b087c4fc1776c9fe03ed3bf43c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121036, "uuid": "d436c3a2-5487-4ecf-b306-2ed977ec16a4", "comment": "Malware payload (Mirai)", "value": "c348bbcbf9ac3bc4e06464ef27fcaa34a33b0287851f089eb67274b89ad3275d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121036, "uuid": "12420078-c292-40ed-a956-3608f55852a4", "comment": "Malware payload (Mirai)", "value": "26169b0860324145db2eee3d012db99d04f12512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121036, "uuid": "f599e3d7-feaa-4ef8-b34b-580654bc86fa", "comment": "Malware payload (Mirai)", "value": "d54ca360394fcd48bc16975e94a65d311ba1b6e81b5b73a3fef4c77f49eaad98f843407d77a1e049690051fb15b6b97c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121036, "uuid": "20d56f23-725d-4178-9414-efad1658e80e", "value": "T110B34BCAB801DD7CF85FDDB644674E0EB970A39246831F26629BFD93AC721A17813D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121036, "uuid": "f5f84a1a-26b9-4bc2-832a-c5a1f54fcf67", "value": "3072:3FuB/MXfxHDozpVGpccfHBwzvJGVtBuMaNOp0nlzam+Kh444c:1uRMXfx5QvJGVDuRNFlzaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761121036, "uuid": "41d69b28-2aac-469a-861a-af11b0ed8467", "value": 113572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761121036, "uuid": "2cdc1fe1-44e7-4b5b-adbb-1b3413fac997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121036, "uuid": "a4109d2b-429c-4010-80c5-1b1a282a709d", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fe9ab8-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761121057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121057, "uuid": "8b16b933-ebcf-49a4-a604-8445b174a88c", "comment": "Malware payload (Stealc)", "value": "f5f9ea2006f686c30fd441e8e43914a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121057, "uuid": "a15ae093-54df-4c82-a142-76a358a136f4", "comment": "Malware payload (Stealc)", "value": "c37d93385f10213d3059eac34996e589f415458989499fd281fdef5b7d929986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121057, "uuid": "d6fe6c8c-be55-4bd6-99c8-a5765434b59d", "comment": "Malware payload (Stealc)", "value": "6eda5129ad0024b8fd6d7bb096c044132e6d1dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121057, "uuid": "e43e3f91-1406-4036-858e-3a7fe6331850", "comment": "Malware payload (Stealc)", "value": "e7ed219c5fc7d28a01752e20d39af6dc478725bbc6bd81b1b4287c0665e96539a15ad04855ccf432311f110111954369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121057, "uuid": "002236b5-aae0-48e4-9593-d236a88d499a", "value": "T12DF523997CF17157CA23CA782885DC2D1310EDD7AA2F81AE28CBFD7B1A7E301A651345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121057, "uuid": "3e9474ad-7471-4edb-a035-e414908ca5a7", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121057, "uuid": "48292e5e-a393-41c6-be68-9cfadf1ada40", "value": "49152:EfrtJBweIQAkiiBkhaLT+Up+74yVRudc8SB94nwRPvnMvf5sq4vH/L:sbIVgnoj+NSBvP25sq4//L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761121057, "uuid": "0cf3e4db-bee1-4973-8bed-1541ce0d74c8", "value": 3624384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761121057, "uuid": "5e02bf0a-79f2-4753-9519-71474d1d2bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121057, "uuid": "9455c049-98d9-4d52-9d29-95a963a36c3c", "value": "SecuriteInfo.com.Trojan.PWS.StealC.393.17469.17734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b927fa-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761137274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "98779603-d5c0-4d55-846f-7e8797e18f47", "comment": "Malware payload (CoinMiner)", "value": "4faada456e50d436649eec40df51b505", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "a308be05-e6fa-4b82-899b-06ed295d47ad", "comment": "Malware payload (CoinMiner)", "value": "c3ef8aba46ac659542d7f6016da40ce0719faeba0054b4675096d5ea3ddbf67c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "ea0fa322-1271-421d-8529-3bd630c85dfc", "comment": "Malware payload (CoinMiner)", "value": "7903f1d85edcdb13e3270687e072e9870ccb5987", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137274, "uuid": "bcccc849-008e-4bf3-b96d-237aca09e691", "comment": "Malware payload (CoinMiner)", "value": "9b0c7bd5b0f034cd064650bc000047385a47e56c34ada25ba156068da99c5aa4055edc6d9025365f653d567373ea607b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "019b676d-5618-4c83-9e43-89ee099b3926", "value": "T1E0263326DD709EACFB162D7BCE921A9D83601F162B4DDC46110FBB180826BF0ED56ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "2a411a41-1444-44d0-8d58-3b5e86ace413", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "e4144eb0-9ddb-4185-a2be-164bebfef210", "value": "98304:hni5OmD7/RW9qbdySTKM7X/aUsJ8uvtkaVjH8CvLfT5RamCHdL:J/s7/bygryUpu1lr8Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137274, "uuid": "e3d36a0a-81a7-47a8-9cc1-a517821d7918", "value": 4810240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137274, "uuid": "5e557f0d-df5e-4ea9-9ee7-c9cf897c9903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137274, "uuid": "9d24d590-0a03-4d89-9a1a-a10ca5299984", "value": "SecuriteInfo.com.Variant.Razy.393455.20647.21046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a082cfe-af6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761153578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153578, "uuid": "1c7f8500-3c81-459a-a69f-6027e1f629e4", "comment": "Malware payload (Mirai)", "value": "26de2b90287e7b27bdfb5976aff43869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153578, "uuid": "a9b28774-3da1-47e0-a74d-4d23dafd3e63", "comment": "Malware payload (Mirai)", "value": "c3f7cf4b69be7bcc3f70465622a093198c73174902d8dd8dfde516f161ba4569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153578, "uuid": "14aa7e47-65f7-44ab-8b06-fa400c9e4901", "comment": "Malware payload (Mirai)", "value": "299ec755b2ee77ed3da2c9c9a4d337e49b848d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153578, "uuid": "d7f2c910-bf4f-41cd-b74f-6d1df183d569", "comment": "Malware payload (Mirai)", "value": "863ec95222b68ead7648e9814c70677e362f6fda2a74ba81069836a19f2903a7f2e34e1fafd3c4bbf283d4e75842a609", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153578, "uuid": "34c137e0-4231-4314-b9a7-fb2fa39228a0", "value": "T15F13F168D190AE6BCDAFE9B0EC7475C1B6A21F46B2A6DF93714AF9009F0114D12C09E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153578, "uuid": "5019a84f-bf40-4ff5-bac1-e6b728ccfb3f", "value": "768:h3R6OSO/wfEg+0LHJtp22AbGI7f2XhS9L1Sdd4Ux9+vLm5Af1mI4uVcqgw09O:yOoAa0f2k9ojx9+K5smI4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761153578, "uuid": "065b3fbe-9d6f-4a05-83d0-7115e11a1b90", "value": 42228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761153578, "uuid": "94873c61-e826-44e0-beb7-ad30cf151a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153578, "uuid": "d432669c-b2bc-4fe5-924b-60c16a7501ee", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128888fb-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149620, "uuid": "406ce12a-16d1-4379-8181-cbab0a21fa66", "comment": "Malware payload", "value": "8753e2c12164809734703b2952e2d4f8", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149620, "uuid": "027c7dea-69e6-465e-a693-b8b056699bd0", "comment": "Malware payload", "value": "c4897767c9da100bf70ff7172cbff2b357c0b01a33f3ab3b96ab6f86d2297296", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149620, "uuid": "b5f9a984-b432-444d-9a0c-e19d4f2f2c70", "comment": "Malware payload", "value": "13352ec84506a99659a63f7b80e62e2d3b9330f1", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149620, "uuid": "09e82fa7-bf75-451b-ba68-10db0715b9a0", "comment": "Malware payload", "value": "02c811184c6c4a1411bcab213386904b51cd9f5bf39713ced7b8ac5ee1aee64c1eea00e9e48c9676eebc5bc4c333c11c", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149620, "uuid": "4e763af6-56b3-4a20-801f-5b59083cd595", "value": "T128A19533C840A55F4AF3025B9EBA9264FDE64A3B4A093D90F59E804DAFF611D8256C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149620, "uuid": "f22d6e6a-0440-41ba-a77a-ed9ccb3f5386", "value": "96:dIxap8Q4Rcud+G6fzhaLMYGDfocY+5q8QKc8r0YESxVJN:dIASQ4Rnd56rhaLMXDwcxw9IZESn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149620, "uuid": "18a64569-f97a-4124-b0be-da2f2bcadf3b", "value": 4696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149620, "uuid": "c8adad74-5b35-4a24-b67f-cf9da424e74c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149620, "uuid": "4c60553a-ca0e-41a7-a91b-8ab3d25fe749", "value": "c4897767c9da100bf70ff7172cbff2b357c0b01a33f3ab3b96ab6f86d2297296.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cdfa3e-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150672, "uuid": "198e1f7f-097c-4956-b7d3-ea50d172b666", "comment": "Malware payload (Rhadamanthys)", "value": "151420053d2b791b8f6c229d3b0b2de2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150672, "uuid": "cd8a280c-eb20-4d00-98ba-5fb894d214b6", "comment": "Malware payload (Rhadamanthys)", "value": "c4dcbf6a2675b073dc875d9becb72569e191840fbe63a473949d4d91ffff63ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150672, "uuid": "898b40db-2f4e-46cb-ae0f-45237875e7c0", "comment": "Malware payload (Rhadamanthys)", "value": "db3afcf92245f980e5e23eb9290f0508728d0087", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150672, "uuid": "c3156499-a9de-478a-aedf-642e3d275444", "comment": "Malware payload (Rhadamanthys)", "value": "0619f3fd412aa44665d86a39d031c387bc2c81a0ed7856e053e575f61401e492b86a4bc093f46b7917b52e69bf0912b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150672, "uuid": "45c07346-bdd1-4982-9e7d-13b797f25568", "value": "T1CDA31981A8BBAFF508113129FECA3571D94CB5465C53329DE809BFA116F861DBFD20CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150672, "uuid": "6161ec2a-d35e-431c-8c88-43b3ee9ca468", "value": "1536:GDB7eKg204jqIjqarPrGEMjq6EjqrmjqUjqpjqYAEjqgjqZjq44W6BkQWJ+aY:GDB7b04lJDbMMWmBsFXmb4W6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150672, "uuid": "be157c78-9d3f-42f1-b341-3ea641eadaf0", "value": 107312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150672, "uuid": "6f58b183-d1ba-4776-ba64-ad755c2f4747", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150672, "uuid": "de59a837-851f-43f0-86f6-635bd4c8e5f6", "value": "invoice-1637482117.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e8c241-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149681, "uuid": "5c619cd1-54f2-4b98-8693-b7bb670380d0", "comment": "Malware payload", "value": "26a61f2e7f8195aeeb0525dd964a98cf", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149681, "uuid": "4e4b96e8-2afb-4498-96d9-ae5f77835d50", "comment": "Malware payload", "value": "c520b4e69be0b921bc01662062d0dd82e4165f91069ed81c49a9b84031e43784", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149681, "uuid": "795ca8d2-32c4-408d-b851-b7a8f2275e96", "comment": "Malware payload", "value": "18bc18275fc047f9674704c19d2980470e3272ee", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149681, "uuid": "b9385b27-7558-411e-8204-36f71deb4a86", "comment": "Malware payload", "value": "ef4fb122ed9bd71f1e69975e2229b3716069a2dd4ad2f9f1f06e8d1e5ee09c4681bc55df2b844a3ee18c380860e006c7", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149681, "uuid": "f5444451-926d-4015-962c-4afeca94042e", "value": "T183122F52CD810CDE07A940BF6E65EA4CB47683BFC82D3E60705DCA76DF666CC42A14B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149681, "uuid": "29f9bd2c-6aea-4917-aa69-b0b5da1c6cd4", "value": "96:xJK0jSzwPFlzPP1YXr+TPziU7WJMzD7lVu6KbHKXPLSc8ZYP/twUptv:xSwdlzPP1YXr+Tm0lVIE1rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149681, "uuid": "646b80f9-19ac-4a5e-b896-994db60c50d8", "value": 9330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149681, "uuid": "7e1ea093-12b4-4fb2-bb56-6907860190d9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149681, "uuid": "6d3783fd-425f-4232-99bc-4caaae93cda4", "value": "c520b4e69be0b921bc01662062d0dd82e4165f91069ed81c49a9b84031e43784.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513e05ba-af4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761140705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761140705, "uuid": "bba10088-bff0-486b-93fb-052e1e478d1a", "comment": "Malware payload (AsyncRAT)", "value": "dd0742a933f39e678aac18ccb5eede42", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761140705, "uuid": "34094aed-5772-422c-9f4a-37eeeed431c6", "comment": "Malware payload (AsyncRAT)", "value": "c5a9d2df9a41e3b205f0c1d0b888b9e190734481a5d2dbf6e9bd490ae2a4a7eb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761140705, "uuid": "bfc22345-45f6-46d6-b928-dab72dbdba68", "comment": "Malware payload (AsyncRAT)", "value": "608a539396ea0ba74c4d65a9275ac79de966011d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761140705, "uuid": "10a4b9fc-2350-4b95-bbd1-37c00784d31a", "comment": "Malware payload (AsyncRAT)", "value": "2ae493a20ae6b369fe614fbd8f5d200cb58af1d954a67b414335b07a1084cb8f4ba3acfdff56799373635fed88054b60", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761140705, "uuid": "2806fc43-ec97-4fb9-b7d0-4aca768d881d", "value": "T113233B007BED826BF27E4F74A8F32115867BB2637602D54D2CC441975A23FC69642AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761140705, "uuid": "ed218682-d323-4827-b17f-07db2107a052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761140705, "uuid": "f19d41c5-3c38-4d2c-aa5a-1404fa69fb9f", "value": "768:kuwpFTAY3IQWUe9jqmo2qLn+2SfO82GtvLNPIfDkAuKPGPS8oE0biF2d5P9DLptp:kuwpFTA4/2c0p7tvLqfDk+PQ5YbiFW/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761140705, "uuid": "dd3e80f4-ec15-4407-acb0-2f97b010a967", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761140705, "uuid": "98a2cc36-b957-464f-8e17-29e41b955e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761140705, "uuid": "85aa0c27-0175-467e-9c07-ef40a3b348e2", "value": "c5a9d2df9a41e3b205f0c1d0b888b9e190734481a5d2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9caba4-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135624, "uuid": "05f22227-9c19-45ee-98c1-236a1a271537", "comment": "Malware payload", "value": "7f9efcb6fbf5ab735f2008e46ccef0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135624, "uuid": "b3bc9a50-c843-4980-8c8b-73c5e81f5642", "comment": "Malware payload", "value": "c851b0eac89ffc1a022e448c65eb0f29ed9a5898c3416dbaf817e95069369f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135624, "uuid": "f9cff7f0-1864-475e-9ddf-57712086fe62", "comment": "Malware payload", "value": "54bf6838b13e530291d94c6e29edfbec4c449f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135624, "uuid": "ce09e70b-cc44-4674-8d67-be75785441e7", "comment": "Malware payload", "value": "236adf902e560f55ca228f25a771187feed2b30a5331a7cb84f02382e0f92f2ca7d68367270839e3bd4f427cfc11b308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135624, "uuid": "e3884035-7b0c-4b8f-b80f-06da7203f443", "value": "T1CBD5330A2B1ECC61C5C40A705679D73A3335DE0CA832E6139FFE6C9F76B2A361665193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135624, "uuid": "5377784f-cd40-44c8-9b34-1723f91f26f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135624, "uuid": "f5bdae51-dda4-465a-8f33-ba124e80609a", "value": "49152:v72XVCFbLuj66nu5waL5R/PFk2wS7p+Ig2Adho5ltFXOMQzGKwbtPYC0z:v72XVkc6qswaHXUS7YeeopF3WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135624, "uuid": "3cb1c368-829b-4049-9920-9abcb388e1e9", "value": 3010056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135624, "uuid": "3c16dc1b-3d21-49c3-b258-f4f3341ab317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135624, "uuid": "01f9733f-d957-4644-a7e2-920bcfa6f171", "value": "7f9efcb6fbf5ab735f2008e46ccef0fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27235e3-af93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170906, "uuid": "f5dc978e-3158-4c7f-b071-2a11082aa503", "comment": "Malware payload (Mirai)", "value": "73e0768d7a315150e1c9b1092317f61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170906, "uuid": "524cf5d6-9ded-42d6-a01c-d786c8ebbb59", "comment": "Malware payload (Mirai)", "value": "c86f1c249611ef501653e6b568a1a54d0a230c8c49f6d0e8a7c49f5adc1c1562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170906, "uuid": "348d474d-8d36-4fe5-8db6-a9add660191f", "comment": "Malware payload (Mirai)", "value": "7c6285a47c306d6dce57cc8ae6d177206972c2c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170906, "uuid": "e6b6cdf4-3f8f-446e-9802-7507ee2c94cb", "comment": "Malware payload (Mirai)", "value": "58453f5d294630b99394495b403f8b7e2c6740bb259b411e6954d9662fb550b4234635506a7ffee07b4455cfeedcae2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170906, "uuid": "d4a80dea-5bfd-42d6-93e9-a0c575bdbbfa", "value": "T18D734DC6A553CEF2D41705B021B7FF328E72F5BF1155E483E3A86DA2AD41682E006ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170906, "uuid": "5cdd2099-a962-406e-8613-91560f939b39", "value": "1536:PxUiQ3DM46jE8tYIoq2Hdhw/Gnjmu4sL9ZYWHfS1cOdhQz6G:cDM46jE8tYIoq2HdhwenjmnsL9ZdKWOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170906, "uuid": "51bcb39d-98d2-4353-8051-7baab03ca081", "value": 76696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170906, "uuid": "b65095ce-43ec-4d90-9320-a411e18aadc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170906, "uuid": "832104e9-8c94-481e-8b6e-031d140d687b", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2904504d-aefb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761105419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105419, "uuid": "ec936961-697f-47d9-ab48-7c291d072f98", "comment": "Malware payload (Mirai)", "value": "572f743e4c403275f7ce8a35ce09e363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105419, "uuid": "74fe3bd7-fb58-4288-86b5-013d9ea9e31c", "comment": "Malware payload (Mirai)", "value": "c9ba86499a80286328ac585643daedb5d43fd40b0cd983ef9e1e2b09a022f73d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105419, "uuid": "70a659c8-9e58-4bf6-9cfc-69d56ae6d860", "comment": "Malware payload (Mirai)", "value": "a1cbf9a8038656ad3f7272ae48ff408987d1c834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761105419, "uuid": "36a3435d-7b9d-413e-a44b-2e9158408cfc", "comment": "Malware payload (Mirai)", "value": "3b3adae1631a48ca3fbe56357176fd2ebb21c7d45d0e59bb7fe87698940e9cf8a3b8ff0d3b304faa50be12a6267d8926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105419, "uuid": "59e27380-02c8-4cec-8ff7-791a53a31628", "value": "T11E633EC6A543DEB6D81205B021B7EF364E32F5BB1516F483D7E89DE3AD406C2A016ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105419, "uuid": "07836a41-f00f-4e91-b305-1fde9607ee8d", "value": "1536:xnSYBn/BpGjJRv2vprcKc3k2hogkLdF2hBCV0goN6GW/BhuRdhQz6os:FnppGjJRv2vprcKc3pho1LdoBcJosJ0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761105419, "uuid": "2e5bfe46-f1eb-4d20-a2aa-10084add8412", "value": 68312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761105419, "uuid": "dddd41f7-9d19-4bcd-899c-959149866776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761105419, "uuid": "402c3e97-d1b0-4303-bacd-677a31819ac7", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c65faf-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1761113257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113257, "uuid": "ed993b75-f3a1-4dcf-bad2-10da1961e283", "comment": "Malware payload (ConnectWise)", "value": "cd0aed3fef3c04e337c850cd46d79dbc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113257, "uuid": "4cc6b4ba-4f64-44db-836a-b67c0e2005c6", "comment": "Malware payload (ConnectWise)", "value": "ca052718653d9e29e76650670c61a17290b9641041e22e433548068b2244c841", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113257, "uuid": "7d8f2178-9efd-49f5-9812-102645574c1b", "comment": "Malware payload (ConnectWise)", "value": "bd5d09967b05512cf6d188030816e66abf70faf3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113257, "uuid": "1555cad0-33d7-4a29-83e8-24b4d4c74f85", "comment": "Malware payload (ConnectWise)", "value": "3490eacb6cc749b33edb22c2f89e24e06eb9303572f98c337710ffb876121948848b428ed1a94f0990d4fed7104dc96b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "maxpanel-duckdns-org", "colour": "#416D65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113257, "uuid": "2466d469-cf4b-44e9-91f8-dfb1cc440c14", "value": "T171650120B6E5843DEAF62A36FF7A92615F39FD251B20C15E8394390D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113257, "uuid": "c70394f8-193e-44a0-9fc4-76462e27f46f", "value": "24576:KZPlmF0uwTKh56Z5vePu/DVeL1pVjeOHnUUGGu/aYmQurhwQUv:gmh69eWbVypVCqgGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113257, "uuid": "8d79b2c4-c4e5-48a6-b7c5-bec8708e332a", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113257, "uuid": "704bfde3-1e75-4a3f-b480-b67bb503937c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113257, "uuid": "d9e55114-da59-454c-afb2-9ba4ed5fb630", "value": "ca052718653d9e29e76650670c61a17290b9641041e22e433548068b2244c841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f06525b-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149614, "uuid": "576b19a8-9623-4dfd-ad5c-8550fcc4a46f", "comment": "Malware payload", "value": "bcf7c8c386f0a57c7bd322da2da7bb56", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149614, "uuid": "96218b7a-efa2-413c-877c-d4a1a9406328", "comment": "Malware payload", "value": "ca503baf456986fdea52a4e6ed937c2cd693b30b6423f12ddac87e46b1c0753d", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149614, "uuid": "75729706-8ff7-426b-9598-a1b66995cf04", "comment": "Malware payload", "value": "fbf526809fd9d7957e032c39e06dbc1b809bfbcf", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149614, "uuid": "eb28fff1-766f-439b-9aba-f0154c47b238", "comment": "Malware payload", "value": "9b3441ac19f15493dd747f0cde6fda42be41df108bae98f61e77785ecd803fa78a38b3daca12894ef8088b1df301c9ad", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149614, "uuid": "9a5c1a24-7bd2-4c26-ac79-e63db55d96a0", "value": "T1BAA164378440565F46F3021B8A7EA378FDE24A374609AD90FA9E804DEFB655D8252C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149614, "uuid": "b5d4af20-8770-44da-b3b1-6a850f3b012d", "value": "96:3EIxap8IEwERclEd+G6flEzEiELMYG1Efoca5yE8IEKc8r0YESxVJN:UIASB5RTd56mQnLMXuwcah0IZESn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149614, "uuid": "c1ff8d28-c2e8-4e5d-9de3-852d037761dd", "value": 4670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149614, "uuid": "9cf4fd4c-c3be-4297-857b-e2e799c9a6c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149614, "uuid": "b8e7474d-bcdc-4cb3-b595-5cfbca226524", "value": "ca503baf456986fdea52a4e6ed937c2cd693b30b6423f12ddac87e46b1c0753d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d032185f-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761131040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131040, "uuid": "8b8819d7-6207-4a77-a1a5-7687ff020a23", "comment": "Malware payload (MassLogger)", "value": "aaa75f2eb3239b815ca13ed28c32da14", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131040, "uuid": "c489f775-81fb-4cc2-8a1d-08f5d6a6f9d8", "comment": "Malware payload (MassLogger)", "value": "cb05967de753c62ff13d73ab30c56f555462ea11f87483f4a54753c6e2d241f9", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131040, "uuid": "63444f94-3ce6-4902-870c-81c2bc01a552", "comment": "Malware payload (MassLogger)", "value": "d4a9764fdf1577ed4ea4256a57603aa80ac8dd9e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131040, "uuid": "52a4c373-49ca-4563-a7b5-1f346cea2568", "comment": "Malware payload (MassLogger)", "value": "72965800b9b37fe7a8fa4f04accecbaa0d02a791577e3a4a232e947ec3912045124395cfff9d482e6cf57c7fa3439ff1", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131040, "uuid": "a3a5cd21-9ea7-4e60-9439-252013569063", "value": "T1E70519F337DF7A4A5A157759A44D29580F5FC0241E83B6D8A0DB0BD4580F88B2AD0EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131040, "uuid": "2606c37f-109e-416b-8d4e-7d270d1f4faf", "value": "12288:kp/P5cYoDT6qn/a46DJwoxuG3XKTWzCavOFYYEMAbPkHu:gPre5i42TEGKTsC7obPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131040, "uuid": "9945f423-2393-4e7e-8df0-4bb35d918950", "value": 841788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131040, "uuid": "dd42c0b5-f686-4ffc-aa99-ea52ec23644c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131040, "uuid": "d9279a73-46c4-495b-b935-4840f87fd11e", "value": "e-dekont.html.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7958a75f-af3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761132612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132612, "uuid": "f3ed5013-0d8b-422a-8971-bb5d3421955e", "comment": "Malware payload (a310Logger)", "value": "25e31c97dc94b172942dc24de6fd71aa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132612, "uuid": "0275c10d-3839-47d7-b372-7514106d227b", "comment": "Malware payload (a310Logger)", "value": "cb277cc06fe6d9ea24a337b203ca68bf4b4a50ce15d7431fa8c8b5db87003884", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132612, "uuid": "60c43426-8cc2-48cb-8581-0477f1ce6a9c", "comment": "Malware payload (a310Logger)", "value": "bb5bdb5b62ffc64dff95e06621bc6e620180468b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132612, "uuid": "eb01ea59-34d3-4647-bc97-cbc719d6df14", "comment": "Malware payload (a310Logger)", "value": "875172b634a568cc19e4dfce1ed71e65fdbe2001582c1f826f8a6378fcb3f8fd6a47266c536ac6655012db15a0512bfb", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132612, "uuid": "51a5aef2-25b9-43d0-91d8-58f37bc34869", "value": "T1CEB43A27EA20612EF053C5F2A9E591567811AE3A1248EC17F3836F49B1716D3E9F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132612, "uuid": "8080e59d-3e2f-4df9-ab7d-76552f1b8adc", "value": "5074e71b4bf9b243f651c52fad5a033d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132612, "uuid": "5a0dc92a-c1db-4b1b-b12f-9988b6fdb33b", "value": "12288:4jYKkJj6GmZUbrfrGNok6jUSycFMaemEVSbd:uYb6nZpNok6jUSLeVLVSbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761132612, "uuid": "a9fa53ab-0ee9-4bb7-8773-6f105ff63bc0", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761132612, "uuid": "5997ad5f-009a-4938-b516-9dad938f1563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132612, "uuid": "51784b05-4d25-4fa6-a9db-060707105ec7", "value": "rPAYMENTADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72cfcac-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761131079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131079, "uuid": "cd713680-b0ee-41cf-8400-31b6fef5934d", "comment": "Malware payload (Mirai)", "value": "627fe37de7e58f0e6507db5846dd6d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131079, "uuid": "4772274a-df2f-4084-a20a-2febfebf35ce", "comment": "Malware payload (Mirai)", "value": "cb4962ef5d24d1de581462a1bb78a4cf528b75a435ec3503b90ee597ceedf09c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131079, "uuid": "019ee155-4445-43f7-af6f-aea77af00b8f", "comment": "Malware payload (Mirai)", "value": "debf160d3c558d48eb26333c1a69445bfe125be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131079, "uuid": "f3a66938-6a4e-4e7e-8f8e-49491b03c5db", "comment": "Malware payload (Mirai)", "value": "12c7beac1b7d4d8f712442aee4777a652cf1462039abda75a20c75932eccceb8da1d4ce4ec4d9e00ab9689ab4ead3a88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131079, "uuid": "8c61ced7-04b6-46b0-9454-de5fa1a1c9bc", "value": "T18ED34B46FB818F13C0D6177ABA9F42053723D79593DB330659286FB43F867AA0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131079, "uuid": "4451f58b-2f6c-4128-b350-bc456688153a", "value": "3072:tMHPp2YS4jM52qSHfFBxxKVbweIS9j6RM/9mmywPoIlq:tMHPp2SjlqSHfFBbK+tS98M/9mmywPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131079, "uuid": "bac59a3b-2e00-4131-877a-db88663b1be2", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131079, "uuid": "fcf22ceb-86ce-4c1b-a19e-0112c5b99961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131079, "uuid": "eed4cda4-8cde-4f80-bc91-23e438bb0310", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bcea89-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150449, "uuid": "595fc86a-7e00-4224-8e4b-515f4a7b4635", "comment": "Malware payload (Rhadamanthys)", "value": "21b97f8be3a586d67875c5882b3aae1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150449, "uuid": "eb515de7-b239-4f0e-a205-5242b89979e7", "comment": "Malware payload (Rhadamanthys)", "value": "cbfaab180d6a99f3f4ecc0dead0e72115ff8f971d961af2475b9fd6fae44b300", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150449, "uuid": "ad671fef-9e0d-4463-8386-2ac83e1ffdfe", "comment": "Malware payload (Rhadamanthys)", "value": "424a99a0232d297717e9ff7f2d8ab3471ebbc037", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150449, "uuid": "b506d5e1-e365-468e-9844-63d565d1e1e9", "comment": "Malware payload (Rhadamanthys)", "value": "78c89ea88939ca14d3b53a73ab6762142d28e4c0edfbeeb02ad3015d96e15c093bd7ac4a85e4e5d9269df9f3157fa33d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150449, "uuid": "34b4d9d4-f1eb-4e3f-97ca-2d74ce91a3ca", "value": "T133A309065B3C9838E2946E9A7FD219F6CC0D0C378D4A2629400DF761B55CE672BC76DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150449, "uuid": "168291a1-523a-4318-b330-a9fa86c36ea0", "value": "1536:GDB7eKg20fLxrDrMPT1TAp9w6BkQWJ+aY:GDB7b0t/Qxm9w6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150449, "uuid": "c958dade-bb07-49d2-8761-cc074c44ce6d", "value": 99360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150449, "uuid": "5e2102de-fc4d-4ae4-a526-cb787dde70b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150449, "uuid": "b42e3227-169d-445d-a2d0-ccc2f315ea52", "value": "invoice-1637482117.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101ddd28-af5d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761147468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147468, "uuid": "ea84257c-7e7f-4442-b4c7-d384c4c95c8a", "comment": "Malware payload", "value": "179c84434d655d47df02e0709e0925ba", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147468, "uuid": "f2b55965-0c46-4660-985c-e5984cf33be8", "comment": "Malware payload", "value": "cc8822f774c155c6e428bb2ec1e642c13e08b9e6933cae222abf7be123bd277c", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147468, "uuid": "f4c42be4-d785-4895-b686-e7ce5d73d5a7", "comment": "Malware payload", "value": "e356ca70026a17ac6438936f1932fcd5a4e46359", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147468, "uuid": "5456ebef-b71c-4ad5-ad69-811025ca59e3", "comment": "Malware payload", "value": "13c7895d5c9763da0f45f7dcc003a02395bada5fa16f62e2bc7611536c58b69152de0a322deab5c667ba23ad48617ed4", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147468, "uuid": "284ac173-f831-4a00-8e6c-1685e15349e6", "value": "T191A63367D3A4705EDD7B80315EAE2261A417BD9BC243874BE93033B869B77D08F42AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147468, "uuid": "76386821-b619-4558-a846-59fefe8a222a", "value": "196608:APzEsdHD+COiVSQsKyZOj/6C8ymXze13Z++i4piEQIPMkteU3vC1m/lxf:AIsYIVnspvCKQi/IP5eSKm/lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761147468, "uuid": "601e6f19-8cd9-4312-9c8f-5b652bae4cc9", "value": 9776760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761147468, "uuid": "8955d621-02c1-4f00-9d89-ef40d26ee708", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147468, "uuid": "638ba2e0-4717-4c3a-ba5c-4f375b0eca0d", "value": "Shorts+Drama+Hub_1.5.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5d09a-af6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761153550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153550, "uuid": "4663963f-500e-4ff1-b8fb-e5e720515045", "comment": "Malware payload (QuasarRAT)", "value": "1e2d454f68ab6ab98b425a366b739da1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153550, "uuid": "bdc9b1a5-9c03-4419-ab1e-f69c4bdf67a5", "comment": "Malware payload (QuasarRAT)", "value": "ccfcfe2d1d0ef829be00c388b38f2150ede1665e26f5b7339661a0df85850dfa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153550, "uuid": "7df0e24b-3ef5-4769-80bc-f95b84efbc32", "comment": "Malware payload (QuasarRAT)", "value": "f68756191669e3587ca6f7f769dc866d3050af1f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153550, "uuid": "9a02d09d-8753-46b2-8a7e-4d53eeea246e", "comment": "Malware payload (QuasarRAT)", "value": "ab71eba4a4775ec75ee9bfdc7f0da2d78d243b7956af413bff65756b54ecf0624231e395cdb804d93d39d05ec26e0411", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153550, "uuid": "efacc21a-e60b-49ea-8154-fede39b6df5a", "value": "T1B5E523387DFE6DCF4928E4ACB79B3C4738308894A44A5DE213D2C89B76D8C550E6B857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153550, "uuid": "5ecd0671-0a06-4b33-8305-08530a900db6", "value": "49152:yaMWmg8DUUUUU2l8vbbbbbeQwX4+E/p1CE80ZzZ/SxnTQJ9o:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761153550, "uuid": "546f9f86-edf8-4d3c-b2d6-9b0d5b04d3ec", "value": 3189310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761153550, "uuid": "3015a34e-530d-4bfc-83ff-6a9ffff67267", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153550, "uuid": "e5b61aca-f899-4873-8e6c-0f36e9b6ab2d", "value": "BootstrapperNew.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3cb19f-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761154411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154411, "uuid": "58bf0c57-beee-41e9-bf48-b75c8a74919a", "comment": "Malware payload", "value": "f2d4234f0d93bad078d90d3af1515e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154411, "uuid": "5c2e1fa5-325d-41a3-9ca7-f95767502bac", "comment": "Malware payload", "value": "ce48c19682c288710b244a717a1b9a1ac464a92ee52e8e7906ddc50ccfe1e854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154411, "uuid": "7e759c4d-4a20-4f9e-8369-df22ee638997", "comment": "Malware payload", "value": "943d8e5b4352f65a96a5fcfdcf4b833c8ad38892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154411, "uuid": "327af282-16f3-446a-8e5f-fb0ef7caf4d2", "comment": "Malware payload", "value": "40c0514301220e9303348743e25b080f32bb382465dd6db01d9ef877c53552b5d330d37397344536df7d32b1e553656f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154411, "uuid": "c3c7f5f5-ec55-4b3d-8ce5-916aed56e6f2", "value": "T1E1446C5577A40CF8ECA7823DC9564A46D7B27C260B60EBCF17A043561F236E19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154411, "uuid": "bedbb522-d66f-44ed-879e-db422d477880", "value": "bdcc417182aff23aa735853592246a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154411, "uuid": "f0c94af6-b879-4137-b54e-8bd171a3550f", "value": "3072:17NB8BCyqJUukkmyl4BBi94KUA9KmrhukKEwEbD2+xlKroU6DDHHXA8sB0sRfmbE:17oQ4BBi9vUA9/r8kKE93jpDDOyHeSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154411, "uuid": "69db668f-5732-413e-bc45-28dc2bb91314", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154411, "uuid": "331f2c8d-fdd0-43eb-8bf6-117a93cf6e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154411, "uuid": "7bc8f93a-27d2-4550-875b-aa6927c2719a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.83617916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a9c05f-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150543, "uuid": "030c5855-8317-43e5-ab34-d18dd77e3024", "comment": "Malware payload (Rhadamanthys)", "value": "989f3d008918a940a9e17e0ccd7503ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150543, "uuid": "24c0a5cd-899a-4c47-b369-607c4acf551f", "comment": "Malware payload (Rhadamanthys)", "value": "ce4ba1f8ab840bdd41744f62af47abd6a3d8504bd84eda51f478a2f3bfbc74be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150543, "uuid": "e26baf2c-ee0e-4458-a229-de9e9ba23d37", "comment": "Malware payload (Rhadamanthys)", "value": "a04c5801cff5d66b7650e92f6d802987ca1b7345", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150543, "uuid": "af0e3731-5a0f-475d-99cf-9ce8efc1e36a", "comment": "Malware payload (Rhadamanthys)", "value": "91df5b825ec3e524123dd538d87b70bcc270af1e61a62e05b82ef99cd1651b28bff265048dc72e2972f65b55a282b906", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150543, "uuid": "78b0d3bb-ecd4-448d-b998-aeadadb7aeff", "value": "T181B33A81B1F3F4D8B336326C7C29E2E46E564230991B7B55726BBB22D51EC940C9D38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150543, "uuid": "c4396cdd-bf40-4063-bc52-63f54de29bd9", "value": "768:GDhd0i7J4sYKgY/CMNfWdIZeTGrXCwraKCEQEHYOcR8Aayhgfu8xc6SSLAuAAroU:GDB7eKg208rBraK7gcAAW8I6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150543, "uuid": "5a680657-5c77-4db6-8c73-036186af4b04", "value": 108660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150543, "uuid": "0077694a-592f-44bd-acc3-03e0762613d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150543, "uuid": "a8f76d75-bd1a-48dd-bc90-3b0b96ca7cd3", "value": "invoice-1637482117.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1fdb4b-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137266, "uuid": "9c10c41e-1046-407d-a8db-45e74de4365a", "comment": "Malware payload", "value": "f8747181573deb76ff7db391bda33f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137266, "uuid": "057b33e0-f999-4683-a339-8cfe85976045", "comment": "Malware payload", "value": "d0190137dd9bbe3d9e076ea7fc4481b450be5606cb16911a1f4706d0400de866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137266, "uuid": "f2d888fb-a239-4132-8b98-b1bf0022be2a", "comment": "Malware payload", "value": "e8b09205aa0fa12579d514b975267d274f1b7267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137266, "uuid": "48450de2-165c-4b8e-a4cb-8be9f3210d54", "comment": "Malware payload", "value": "034d91b8edf8bdade072cf36bec9fca7a7271252429ada9b0cb04d58d07726daffb2211238426ee99c52acd8b5673bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137266, "uuid": "23cf697a-398d-40d0-a99c-4dea8a2833d6", "value": "T1020633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137266, "uuid": "89e764b9-65b8-4e9c-b3f8-8bfc151dd9e4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137266, "uuid": "cadc83d3-2820-4b35-8055-272c1ff2d9b6", "value": "98304:aVT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:+2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137266, "uuid": "1c91d081-cbab-4eb3-9962-b04751f89183", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137266, "uuid": "e305dee7-1e6b-4163-914a-fab09bcd692e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137266, "uuid": "4be67548-7245-479c-8d61-994e8d53282f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f99a03-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173296, "uuid": "1a3bd15c-d0eb-4c95-95a9-36e9e7785255", "comment": "Malware payload (Mirai)", "value": "a4428d87e52de786541b564b089e9712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173296, "uuid": "cfbf0650-1d2e-4242-9c8d-aa5e17e690cd", "comment": "Malware payload (Mirai)", "value": "d2dccdd350114c67bcc4953c4ced625e5ddc8a631468e38e9fd6bd654fd839b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173296, "uuid": "2808f549-d214-4adb-85b7-cb78b87754a2", "comment": "Malware payload (Mirai)", "value": "c3e6b51ec1d5cc0149baec07e21c94e9403c3c4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173296, "uuid": "c160efdc-e9ed-44c1-a518-394a7ae2f515", "comment": "Malware payload (Mirai)", "value": "6a4835ec827292ffdf867040eeaff99657284ce7b01fa2b17b962cfbbecc694a0da058894d4b7edde064b0e1f301a663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173296, "uuid": "aa0eb8ea-7d0f-4e2f-b0e6-49f6d1f0ef48", "value": "T170041A45B8819B16D5C112BAFE1E128E33132B7CE2DF72029D246F247B8A97F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173296, "uuid": "6492bb17-3a7c-4e4a-8320-139157013694", "value": "3072:eIa6T77bwipAX5EcEhPayyXqxK0WqaEb6UUtq0lPuMZOZM6fWp:Ta6T7XR5cuPYXIKIa3lq0IMUZpfWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173296, "uuid": "848586e1-3cc6-47d9-9195-8871b102078d", "value": 174880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173296, "uuid": "024f7874-03e0-4114-a0ad-38d387ae8b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173296, "uuid": "e7f442ad-697b-454c-9562-649f5e57eb08", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c2b75b-af67-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761151907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151907, "uuid": "c220da2b-900b-4269-b548-66fc769f3830", "comment": "Malware payload", "value": "cdc9889633b69a69eac97af3e88f353f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "UACMe", "colour": "#C15EEF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151907, "uuid": "26c6e7c6-47b2-4573-bc32-6977efb855a8", "comment": "Malware payload", "value": "d30c9c33d6ccd241358b02d37686f7e65a06cb75ec41c16e546d61aa90729c10", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "UACMe", "colour": "#C15EEF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151907, "uuid": "693469d1-2af7-4cfa-b86d-fe11fc5b757b", "comment": "Malware payload", "value": "9ed4a9b0ad7104faf81ef7154973f80d0da17339", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "UACMe", "colour": "#C15EEF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761151907, "uuid": "7233f026-18dc-454a-ad87-e421d6f08ff1", "comment": "Malware payload", "value": "f1618760edb2670b2ec12fec628acdfff03f6dbcce7b1e823e2b68b0c756f6137671168ce098da20b465152dc25c6d20", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "UACMe", "colour": "#C15EEF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151907, "uuid": "49e44535-db0d-407d-88ed-6d8187a9e2be", "value": "T18D646C0FD7CB15FDC66180B663644773E521BC09C2798A235790AE122EAB27DED39B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151907, "uuid": "4fefc356-4bb9-452d-b5ae-2d46313a0504", "value": "3bf9bc935a59cc47fd3959cb37632609", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151907, "uuid": "a2f65b7e-e171-4246-96d7-dab01593fea8", "value": "6144:1ejZTB0h1eGIZMohVQu6vAzXk029URhjjUteqY0l:cjKaZrQzYUU7Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761151907, "uuid": "113f0d21-239a-470e-b1e0-c2a096858be7", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761151907, "uuid": "87e666a6-abe9-499b-b0d1-c4bdc3c2f6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761151907, "uuid": "dc48eddf-386a-46a0-ba34-3589b675c0c8", "value": "2025.10.20\uff08\u8fdd\u7eaa\u4eba\u5458\u540d\u5355\u4fe1\u606f\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ee86c7-af06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761110494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110494, "uuid": "9931c5f5-0937-4578-8155-64de9ab96e98", "comment": "Malware payload (Mirai)", "value": "192d89e17abac67969affc54bd0b0f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110494, "uuid": "8e61b3fc-2631-4fee-974a-aca2424f751b", "comment": "Malware payload (Mirai)", "value": "d4315cca9cf857ae7c28dbd2a29e7b540119c70a83591b1fc9abc38756154492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110494, "uuid": "dc421b41-4d80-44d2-b7ff-30f33c2801a0", "comment": "Malware payload (Mirai)", "value": "458c3d05ad601289fcda55b08ed9c17b0a6c33b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761110494, "uuid": "4f08bbc4-f5bd-4c16-aa26-78944591067f", "comment": "Malware payload (Mirai)", "value": "e21562e12eff987924ace452311e3c4a765fc350c582e951661832efcee913f666a3d7a59718043e8b6ab023336eb1b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110494, "uuid": "456333ee-f412-45a2-84a0-8857306cce73", "value": "T1B663E752B8819B26C5E013BAB5BE52CE372073FA92CB7127CC610B607B9641F1967FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110494, "uuid": "3b0215e4-65c4-4df3-9964-a6cde2265ac7", "value": "1536:D/KPS6BvXu167LfkZNFnRzAPRVOdO7YUPv8pPi+1gAO2noSF8LzpjdhQz2GrEK:D/KPUpPBu2nHSLzpjdhQz2GIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761110494, "uuid": "f6320501-8a02-4e2a-8cbd-113c27c4add8", "value": 67444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761110494, "uuid": "c1f71661-8f49-4069-af01-c032eca8c8b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761110494, "uuid": "35e8dc13-ca43-4d74-8321-4223affd8849", "value": "kwari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac79b718-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761130980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130980, "uuid": "07edd84c-58a2-488d-b54e-15696fd76dde", "comment": "Malware payload (MassLogger)", "value": "aaf22e529087656b430d68596a29a55e", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130980, "uuid": "18fe4317-bfea-4630-95eb-6d7665b74c25", "comment": "Malware payload (MassLogger)", "value": "d54e191c821eca4d5eef60354d06bd0c0023325a4b500d87a2dc04ba9204a166", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130980, "uuid": "3b4703e8-3ee5-4c11-8cd7-d831b1da3cd8", "comment": "Malware payload (MassLogger)", "value": "a8e804017d0123131702ae08e1559b7dd510fb28", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130980, "uuid": "f8b6a2c8-6b36-4d51-933e-d5fc0da4edb4", "comment": "Malware payload (MassLogger)", "value": "ea07117098433c247e2e1c9e7105b8108b3dbafb2a12c99ab2d943a57d3b4b601622e4b91e1440bdacc72216e7ea810c", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130980, "uuid": "1444a09b-2192-42df-ba1d-df606331c0af", "value": "T154053AF237DF7A4A5A05775AA44D19580F5FC4341E83BAD8A0DB0BD4580F88B2AD0DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130980, "uuid": "bf071680-17d9-4a08-b7d6-edc277dd5116", "value": "12288:yS58zgEeyDK7qmqgaceKiHG3Zb/JuUnaW9nPuSPw2/8BENlfsdJtgOiZ0:RqzgyDxFgCDGnaWZPlB/5SZiZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130980, "uuid": "fed32240-d166-40dc-a5b9-fa63a2b47337", "value": 841740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130980, "uuid": "866d0b82-7a9c-4a63-961e-f66472c0f76c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130980, "uuid": "b282caa3-1911-463f-8bf0-89a5430a30bc", "value": "TEKLIF_0001048.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8e5863-af92-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761170361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170361, "uuid": "53d1ab73-69dc-4b6b-bce5-da38028f44e6", "comment": "Malware payload", "value": "4cf36dd4ae042afdc142fdcfa4d80311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170361, "uuid": "d4694526-5a74-43d9-aa0b-f18e873accfb", "comment": "Malware payload", "value": "d59ee7e62c7a1fe52ab7fc649e6675eea2755a53d34f203aee0742a6261c1d7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170361, "uuid": "39c54f8a-2b00-48e6-939d-7247e6cf3ea8", "comment": "Malware payload", "value": "61539e003fea5f9931d38801043c9618f65b030c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170361, "uuid": "ae287b84-6059-4893-91a5-d8e8d56bfb1a", "comment": "Malware payload", "value": "8cbfbedfa470f41c3face196f12457f4ad632052099c9aff29d1ab4341b46b71a2137dc3ef466f01d3c747dc56c15646", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170361, "uuid": "93313058-d9e8-46e5-bffe-4a4a820952e3", "value": "T126A3196AFD41C611CAD21577BA2E428E372B42DCD3EF32079E264F60279B95B0E7B105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170361, "uuid": "27c23c8c-8e91-4cb4-bc4c-119559668516", "value": "3072:rICQ8SBgvIuQ5l0l2ldltlhl23lh6lFylelNltkl6lYOlPl1lvtlalGlYlRlqlZT:rICQ8SBgvI35aUjHbo3z6fyUf3kESONt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170361, "uuid": "acd73fa4-835e-4a24-b552-a8c90c7a3ce6", "value": 106400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170361, "uuid": "61842772-bd58-4a28-a235-822152f3093d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170361, "uuid": "0591e426-4773-44ad-bd50-3b270fef2f59", "value": "rondo.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99604cd1-af32-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761129230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129230, "uuid": "0593456a-f86b-4d91-938d-b7fdd24b1b5b", "comment": "Malware payload (RemcosRAT)", "value": "31b0691f40d5c1b81e2720bf4cba77e7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129230, "uuid": "73d4fe0a-0aed-4382-8721-67460c05cb26", "comment": "Malware payload (RemcosRAT)", "value": "d694bb92b2b7f2855361317b16a7229bd25460b748044d8fa13c2f5f5ee173dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129230, "uuid": "6b862425-2879-48ba-b829-6eb7d0bf84d3", "comment": "Malware payload (RemcosRAT)", "value": "af23dcb033a7613570b669fd921d1acb5e72db5d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761129230, "uuid": "c68d2b7e-04a9-4fcb-99b5-8b440c2ba60c", "comment": "Malware payload (RemcosRAT)", "value": "74db2af8719edd9b068e42b4dcd9acc5ddf97cb0739ee39b2e8763d6f1d80ad0baf2467e0b79334a771f4c76db2cd07c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129230, "uuid": "803c4c48-5160-4b53-8a82-c007b9dd889d", "value": "T1F56423640BCB6287D3D382FC466C8965BFB63603601B23B5B6B4C28C9E7875B5337649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129230, "uuid": "64393134-700b-47e9-af22-fd5561a09c6f", "value": "6144:CzM9KPuThcPhAeXsiz6Q6lFmlLU8WhM2LWq4YmP8QNB/1wMs/x5hLJzij:Z2tsiilF4LUTJLFmUa/+Mspfgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761129230, "uuid": "df7f8670-2ec3-4baa-98b1-b5c7a48d2dc7", "value": 320460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761129230, "uuid": "f6a7b039-770b-4d17-93fe-52283ddc0201", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761129230, "uuid": "06d20325-3a09-4336-a2c5-46695ad34525", "value": "factura restanta.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c2e54d-af9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761174611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174611, "uuid": "7ecb019a-97b9-4595-8ad3-d0e4d99d7a62", "comment": "Malware payload (XWorm)", "value": "7a5de8916184f572a66d7944e4b2bf68", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174611, "uuid": "510c87b0-53d5-4601-a721-50d09e6a6fab", "comment": "Malware payload (XWorm)", "value": "d6c61130ce7fa224c52e1c6b3656c1bd5094b0bc4f05c69a8c559c9f5a6542fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174611, "uuid": "63eb00b4-1bf3-428b-adb3-83e75712ae2d", "comment": "Malware payload (XWorm)", "value": "9ec73c6bf72af38567499801b19b9d0c96663de4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174611, "uuid": "78b076ae-4cb6-44ad-bfa0-8fa18ef32dc7", "comment": "Malware payload (XWorm)", "value": "1ce1f1b6e90f93e53d61f3480843c5ddc014754449e08d5aa0ead14df7e49432fc995e4d83c02d428a97e160ee78bb49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174611, "uuid": "0027e483-0173-446a-896b-08ea4fe3e9dc", "value": "T11B048128DBEC7F9D625524BB643EB6D000126B51D53F8E4C8BC10AAB4FAB35866353CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174611, "uuid": "7ca41f37-7e3a-4f8c-be2a-26e0426d922a", "value": "3072:yhzPTwk/R0V/tB2ZbCpp2Q++7n5iM85mvW9:ypPcgitB25Cpp2Q++D5iP8W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761174611, "uuid": "2afe1137-505b-4150-8c6f-0b55dea977c9", "value": 181345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761174611, "uuid": "81502fb3-443b-4bec-98b9-ad516f588973", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174611, "uuid": "bd72170b-7c58-413c-af16-e61cbc135dd1", "value": "Specification and Drawing samplesJPEG File.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cbc7c0-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138371, "uuid": "ea315293-639e-48dd-b550-22288e446b33", "comment": "Malware payload", "value": "f068475a893770c1054a3b80d02fb221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138371, "uuid": "3d6809f8-bbec-44b2-8aac-71862e352b46", "comment": "Malware payload", "value": "d6ee5510cc0ee35e9fee5cad75ff7b4bb19f834ade34afb194069fc6ea6d2221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138371, "uuid": "f3afd5c4-58a2-4f6c-825a-c79ec96e0362", "comment": "Malware payload", "value": "15c08cc3ad7b293d1ef532aafcf31319a9464302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138371, "uuid": "a7a0a981-c81c-4fb9-9988-48074f9d77e4", "comment": "Malware payload", "value": "f7a007f367e167b016949cc40ac46ee88856d6076c10ef65f1624ce9722f781a34d29fcc9819afc50c281f32fc282ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138371, "uuid": "8d2c5b42-e1c6-4317-ada6-bbd547e953ad", "value": "T1D2F412087B5ECD22CDE56FB54960E3B52A389F0DD910D2138BFD7DDB706AA26281E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138371, "uuid": "d89008ec-a1a6-4acb-8fce-d38f53080fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138371, "uuid": "f031792c-103f-4c3a-aee7-5f0691caaa2e", "value": "12288:PuYx5JcBBMewv26PTW4cdcC99vxS5tYm1hkFuRPLSXzqjKj21zfekT:GYP2BB826S4CjP5k/SFYP0ejKj21zfDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138371, "uuid": "49a1b995-8495-4bf3-a987-64c067ad0555", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138371, "uuid": "2980108b-2c5d-4ebe-8c91-4b9d7f010306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138371, "uuid": "1f705b11-dc5d-4628-be8e-66626418e05d", "value": "Ziraat Bankas\u0131 Fatura \u00f6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea74de4-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761131011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131011, "uuid": "677e9846-4553-4f5a-9e0b-7d518cbeaf7f", "comment": "Malware payload (AgentTesla)", "value": "a31d678257af9605ec1030b7153b8128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131011, "uuid": "353cf111-5d87-40cb-9138-cad5d3c6d9ab", "comment": "Malware payload (AgentTesla)", "value": "d6fc5f9611c4d44858277a1c792ef65f864b0933a5abd3ed0d209714a8be6aaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131011, "uuid": "0af61515-127e-45f5-9784-de161951294a", "comment": "Malware payload (AgentTesla)", "value": "12f3e136398cc5d0083135ff8710f68fb69f2925", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761131011, "uuid": "0f258070-a99d-430c-845d-3dfb80c4ea5a", "comment": "Malware payload (AgentTesla)", "value": "62202db5dc3b844078c33615141bed302aa71d2c697bec38e1d94e66cd64d9992418a8a610f80c3ff12ea65c49ef9544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131011, "uuid": "732ee69f-fd01-43a1-8679-2aecdcac6376", "value": "T1375533F51E388C2CF63F4DB9D396AAA95171902BF58FEE0645E60D7E0F151B0B890A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131011, "uuid": "51da0214-172e-4fdd-9fd7-f649daa572a4", "value": "24576:ffs73HploRq+rG3sxUV1oRLt5E3zb9eVcDhk/+WA/PFQpxup1pSS:fqb+rG8+Lo9zE3wVl7A/dSUVSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761131011, "uuid": "7701f471-baed-44f7-80d4-7de5f6abad6d", "value": 1342145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761131011, "uuid": "983d0030-2dfd-4ec4-9c83-012848f1ef8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761131011, "uuid": "4503e827-5d9b-42f9-8653-1ff0c2e1e2c2", "value": "New order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b621b75b-af5c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761147317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147317, "uuid": "d5a0e407-48fc-4d82-bba3-76f92c457486", "comment": "Malware payload", "value": "1fce132680280fa79943096ef1576dfb", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147317, "uuid": "312d79b4-8129-44cb-8d6c-6ca608ef8022", "comment": "Malware payload", "value": "d78bdbed31b98e4cc52fa402055ecf755ad02e7bc73c388362993ca22b626308", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147317, "uuid": "0319cce7-ff18-4140-aea2-4fa04fb893f0", "comment": "Malware payload", "value": "babff7572c435a9ee2142f3c0c1376c27b8062b3", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761147317, "uuid": "1f953ba7-5f2a-4edc-ac7d-4764dc8127e8", "comment": "Malware payload", "value": "c94b23dea54d96b0aea73afe90f2a841efa90629e17a9e44403a6d9726a4c577e31bc25b98e4440946aef3c1705d516d", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147317, "uuid": "1ab317b7-2a82-44ad-bc74-2da0ac4fd0d9", "value": "T14307129AF72D612EC43B403A8C6A6236555A4C57DB839B03B514735C28F35D88F8AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147317, "uuid": "c70231ad-a6fd-45b3-b6fc-0b614e367e3c", "value": "393216:x6L1hDno3qao+elmbHaaDK0TXwSRvpf9pbv3eIV3Ras585hA:xudbatrbTDK0TXrpf/L3bV3J5yhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761147317, "uuid": "9ab3818b-5299-41de-8d4c-3a00ab1909de", "value": 17792268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761147317, "uuid": "b3787754-687f-450f-aacb-08c59b1219aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761147317, "uuid": "84023658-20f0-4837-8544-22fff6bcd4d8", "value": "Easy+Pure+Cleaner_2.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f94c4cf-af00-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761107551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761107551, "uuid": "468507d1-0028-4abf-ad3a-1dc406db05ac", "comment": "Malware payload (Mirai)", "value": "eb0e80d5b8dc89e37a42f33d0c574fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761107551, "uuid": "ccb0d98b-5013-49d1-a8de-a993b1fc8c07", "comment": "Malware payload (Mirai)", "value": "d7abaebe70e8c5ab536e6debd51ee3f75797a9942da7fea4127c4512811ba59e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761107551, "uuid": "3bdbbfdd-b3ce-41b3-8553-7a12d69dae63", "comment": "Malware payload (Mirai)", "value": "2deca9ab90e0bf03bf380b63da7ee4cc8e310f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761107551, "uuid": "a322b5b4-d25f-4dc2-bcca-346f78dd1963", "comment": "Malware payload (Mirai)", "value": "d797e5cc82524c0fa957a2dea41a465d9c1a9962cee99713ba0e71e351df0f595decc841cd2f8e6ae41e9030d4a880da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761107551, "uuid": "dfa2405a-bbcf-4bc0-9a80-84bafbfe18f4", "value": "T154734B5AB802CF6DF807A5F914624E08BD6177961AD30F17EABBFCE32E720D56901D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761107551, "uuid": "0de54413-9315-4e6f-bdf2-22aff785d195", "value": "1536:f0yhMe427w12QJ/7O94YovHJ7QAMZ8vgtsD4lrYLO2GCn:f1427w12QJ/7O94YeHp09BlsLO2GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761107551, "uuid": "4f58205c-18fc-4314-a53a-b91146abe8b1", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761107551, "uuid": "dd82ea8a-8760-45a0-b02b-52f384650e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761107551, "uuid": "1b2c13ba-788b-4254-800b-e0f44d4d5879", "value": "kwari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716c659a-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137753, "uuid": "a2902242-ab24-4155-9040-30b6166f2014", "comment": "Malware payload", "value": "ad8bb0ff4687cba1e231853c1ed0435e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137753, "uuid": "2890a86a-39d6-4edf-ba47-e484c660a44c", "comment": "Malware payload", "value": "d95cd098b57ae2d9a03396ece8ad652fb695320d52adb03658590579f7d4a67d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137753, "uuid": "de7f5656-d84e-4248-bd06-e0290f26a485", "comment": "Malware payload", "value": "f39ac94f919df3085b4d412c9bb7d0dc6b30d0be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137753, "uuid": "d521e99e-ee91-4ece-9dfa-f592f0133fab", "comment": "Malware payload", "value": "7612e05d760d603acf54b1aa3a6cdc4bba0b2cdf46c006d07bc8495421da15aedd61f9599703473ab03c396464eb78ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137753, "uuid": "4f120779-6adb-41ee-9a71-c6fa6160628b", "value": "T10C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137753, "uuid": "7d100f31-3a6e-4208-9884-e49c53bfbb9e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137753, "uuid": "169c9f02-ce11-4965-99db-330e150f5f54", "value": "98304:agT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:T2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137753, "uuid": "c360d725-86b9-4eaa-9b3f-45213c5ee3f5", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137753, "uuid": "a60f7cbe-eecf-4a90-8874-2bff14fa44e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137753, "uuid": "491b506c-7659-492f-9e8c-21d92ab8e092", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908a7360-af89-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761166581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761166581, "uuid": "123ed1f1-324a-485c-ad08-38970797dfba", "comment": "Malware payload", "value": "de2cd072cdc0f19e6dfcecc88c1a3ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761166581, "uuid": "f23f4246-386d-4b89-85d8-c546fa58b89a", "comment": "Malware payload", "value": "d992c73e968f72e7f48dae84cef614ab747b9f8b33c6d183b5257cb47cf6e95a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761166581, "uuid": "2681e215-064d-4307-a558-711b0e4e42cd", "comment": "Malware payload", "value": "2ec7b9cf1287adb8ac925c88500004f39f58e62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761166581, "uuid": "f0bcdbd7-d57b-468d-b346-b6fa211d1d40", "comment": "Malware payload", "value": "a96d02106a6f2b9b35741081ba9a20f131ed44f10bfdbb00027fe652492898984d2d11a1f459552223b97f27f492023e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761166581, "uuid": "b0ac2a89-ccf6-47a7-b2f5-d4722dbe9a4f", "value": "T113473360C3E418EDF1FBD93C90279E16D26778602F65D69B2DB003915FA72C44B3A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761166581, "uuid": "8ba37a89-415d-47e0-aae1-50028a98e35f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761166581, "uuid": "deca31f0-df28-4f6e-8a6e-5271e6fe0bd2", "value": "393216:34h+FX/dYbt9oavC05y29DqDCO+/pR0elk6xQR+y5rf8DU7HXu76mdUSCN7wO:34IFX/d0tCEXdJL0elY3S79qJN7wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761166581, "uuid": "95c44c19-0416-46ae-9d1e-0c6bbb64cac1", "value": 25369905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761166581, "uuid": "f5a872cb-4840-4fac-9bb3-29db7bec6408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761166581, "uuid": "c799c83f-7670-43e6-b9ef-0886a35630a6", "value": "final920891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f88c63-af58-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761145349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145349, "uuid": "241c443a-eb1d-447b-800c-0833711424da", "comment": "Malware payload", "value": "e8e7863dd261bdacc27c98354a53391e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145349, "uuid": "3787ee42-16ec-4521-9f1a-1f04b502f03c", "comment": "Malware payload", "value": "d9edd707df3689a2915929362f59cc5fb67f95f6a657189e5825d6fc6547cfb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145349, "uuid": "c652e6af-2c60-45ad-890e-cd5a67c13d79", "comment": "Malware payload", "value": "da459aec2dad81c4e12e07f8378663309159966b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145349, "uuid": "79b7c41f-c363-4c5f-868f-f30e4c25f2d0", "comment": "Malware payload", "value": "cf470530bb16909052a42653272961479ec4b8126dc6d6c7bcb1037d22bc35a90cd0f2214e32d2916713cd454db00f73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145349, "uuid": "633d9012-33a6-4bcf-a72a-fb5aa5b99f3c", "value": "T124F36D41F65081BEC55F00F694FE93BDE734A4040B21B9E787D08DE89DAE6D14BB922A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145349, "uuid": "17fe2639-4552-4b9f-8505-5959fe5f4ac3", "value": "6fecc0c0ae8d9579ed143403e9796fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145349, "uuid": "ef92c561-5d08-46f0-bbff-f613ebcadf76", "value": "3072:xnpnghczjBTgjEx+SdeIxH2JkRjZnWVPPJwdJBiTiP:xpghczdui+4eWWJMtW1PJmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761145349, "uuid": "ca716756-b394-4257-bace-75d44969a9d8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761145349, "uuid": "8c1baeda-e588-44ae-b694-94b3eabfa077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145349, "uuid": "8b286d2c-28a5-4001-8b57-fc1596235358", "value": "index_win32_ia32.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67768c99-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761137736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137736, "uuid": "0fe1a2b1-331c-4e30-b22c-e269552d3508", "comment": "Malware payload (Formbook)", "value": "e5b15bb99cd13615fef21f002a79bb16", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137736, "uuid": "ab7c25fa-6cdb-4c7e-bcec-8887e77b597e", "comment": "Malware payload (Formbook)", "value": "da454ebae3e171d8adb872f940d08d614cabfea8bd9a340def597abaf5a90879", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137736, "uuid": "366b14b9-4d9f-44de-8899-d39be87200a3", "comment": "Malware payload (Formbook)", "value": "f22d5d598dc5ce1bb2ad5b60bd1bbff2c90353c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137736, "uuid": "974ef9a3-d420-4693-ab6d-d1b6aa7c296d", "comment": "Malware payload (Formbook)", "value": "36f90413afd63057bb92628bcafee20a9f506c0a5db54ab8012cecde93e7def29c235c2cb6bff6d75bf8c26e035048d6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137736, "uuid": "42a0f973-0159-4f8a-a42f-e968b0d2cc74", "value": "T1EDA5AFF876047DD6666F566BDE96ACDC03B627239ACBA4CC8064B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137736, "uuid": "8ced2001-aefc-4663-918a-a9f16a200a1c", "value": "24576:aUA9Rr6O1N9OoNm6lnArTaz6oT5k7arglS5uav6mhbsaXzmQyBJ45XNK78wO0/R/:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137736, "uuid": "c723657d-11ed-4a0b-aa33-5cb437975a43", "value": 2192976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137736, "uuid": "ae37cdb0-dc6b-41ee-a851-c58ec0773562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137736, "uuid": "436937ff-d909-4d1a-984b-c305b945bcf8", "value": "sird.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b76bb9-af4f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761141463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761141463, "uuid": "72714e64-cb05-40cf-b65c-75d2ab44e582", "comment": "Malware payload (Mirai)", "value": "3d6811566365826c3cebf081ae3aa42c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761141463, "uuid": "4a9ff1a1-bd87-4871-928a-96cc53b09566", "comment": "Malware payload (Mirai)", "value": "dab0269895d7644433c90f569b409cc65d18ed5a8c1c98ec51551a9e792473e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761141463, "uuid": "3eef6f4e-091e-4710-987b-80de97fd0fcf", "comment": "Malware payload (Mirai)", "value": "71fedee35847f996e3de335c3c930713de2e4f70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761141463, "uuid": "9a94bdde-4575-489f-8338-00ac09830fb3", "comment": "Malware payload (Mirai)", "value": "e67b422b04be8c390762b858e671053fe97ed42494cf862cd2edef0a6507ad8d100366cf37c181373d2563192bd25ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761141463, "uuid": "08f39b16-60f7-4d3b-8282-cf8f87ae372c", "value": "T16A04BEA3B74F2091CC6106F80BCB6B5D263361029D6BD6E76C6E763A5B370DE59023E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761141463, "uuid": "a17acd41-4a9d-492b-83b4-8eeb01c0c60e", "value": "3072:JoFnr/yS+5/TzTCXYXzBghtQyXZKzdy4yGG+lp2oE1gdC+4+PRfgLqR:JoN/ybPFGtBZWdnlpbEKC+4+l2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761141463, "uuid": "8c58a7d6-875b-4d7a-977e-ee663d6df7a7", "value": 173708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761141463, "uuid": "12d61627-cbc4-4772-bdd1-d168e76bf1ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761141463, "uuid": "53fe6d30-5a2c-4d64-a93c-397af612df3f", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506b508a-af60-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761148864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148864, "uuid": "921dc27a-16ca-4d5d-b5a2-e4c2bd727bb0", "comment": "Malware payload (Mirai)", "value": "b88724d68dcbb6b51df6eb65b1581ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148864, "uuid": "3442ff28-13de-4792-bc47-01e15eb7fd61", "comment": "Malware payload (Mirai)", "value": "dac057166874890039efab75c398dcb50427750ba65379398ebf453a318f7b8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148864, "uuid": "d5dbe72c-3b03-4a25-b222-8b3bc180f014", "comment": "Malware payload (Mirai)", "value": "c6b691b6c024f1242d739be57d93798a95e39bad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148864, "uuid": "d19a1953-1536-48f0-a411-c6184c07c1af", "comment": "Malware payload (Mirai)", "value": "3311740e553e52c65b6f671c1bb824c75c91d482b8618e030d6f6650762f9188afd71e704c52bbfad477b62f251253bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148864, "uuid": "ba4e2942-52c8-46b1-a8b9-c47e5d2cf60f", "value": "T1EED36CD5E643C8F3F56301F10527D7358732E83AA026D953E3B9AD35AC62991DA2B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148864, "uuid": "f81e1b24-3c8f-4e12-b11b-58c0a2f8f457", "value": "1536:7dS+Z9HwrwGqhdTGqU407Qi+E6j5xGKA11Ip/LJV/J/PWOz28xCY1JT/rJVQK9TV:5Qr0wbWeKA1upDD/J/eO683FFT+2rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761148864, "uuid": "b288586c-5be8-4544-915a-037c11b3d9c8", "value": 139568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761148864, "uuid": "9055615a-eea0-4b45-a9eb-449bce36df93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148864, "uuid": "5303bae9-3d6e-499c-bc4c-d7ab78a4f6f0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313998ca-af62-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761149671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149671, "uuid": "ddbeb0b1-c073-4a07-9c97-12fee8d4d7dc", "comment": "Malware payload", "value": "f2aa4f141e2684661af3f703fb6ab75c", "object_relation": "md5", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149671, "uuid": "6610f43d-b902-4d76-9a8c-c07183d08484", "comment": "Malware payload", "value": "db1cf0e09ba67ce50e64da18cdf86cb4450d5b0a75d6c5ebf3a54a7af6c8f614", "object_relation": "sha256", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149671, "uuid": "383bf10a-444f-478a-ab2e-80474df6306a", "comment": "Malware payload", "value": "c1dba7391907354d58a1f7028f84bfc874e5e8b2", "object_relation": "sha1", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761149671, "uuid": "89c0b23b-f9fa-4e52-aafe-92f4b7eb3e26", "comment": "Malware payload", "value": "e2d6ac9c9ddd9021fbe4c81f2f2e7b52c757c8a00a74c13c8c6b918616408ad048b488fb77f947ac5ad383b501bdc1d1", "object_relation": "sha3-384", "Tag": [ { "name": "45-144-53-213", "colour": "#A486A7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149671, "uuid": "4af78cab-90a6-4785-bec4-53fb196a3598", "value": "T10D122F52CD850CEE07A940BF6E65DA4CB47683BFC92C3E60705DCA76DF666CC42A14B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149671, "uuid": "4f588f5c-9a6a-4053-b179-1c134cf9edc2", "value": "96:xJK0jS/wPFlzPP1HNr+TPziU7WJfzD7lVu6KbHKXPLSc8ZYP/twUptv:xcwdlzPP1HNr+TmplVIE1rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761149671, "uuid": "459cce27-bb0b-4597-9e2c-559e78ed9cfe", "value": 9315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761149671, "uuid": "23476017-7ec6-4718-a441-93e749e2c040", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761149671, "uuid": "a9ef0812-8d98-4650-8864-3e4b801dbff3", "value": "db1cf0e09ba67ce50e64da18cdf86cb4450d5b0a75d6c5ebf3a54a7af6c8f614.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5615cbd8-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150592, "uuid": "9686776c-5967-4587-958d-6253c73f9ceb", "comment": "Malware payload (Rhadamanthys)", "value": "d8cc74cbca9cfb7424fe22e23b49877e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150592, "uuid": "92febf59-2bfa-4566-a1a7-b0d4b43e2fff", "comment": "Malware payload (Rhadamanthys)", "value": "dbe7fa87f72e905dbc4a3ba94e7b43642ea5c0c64c6457ead46ce1727514fba9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150592, "uuid": "03d03ed7-f966-4eba-8cf1-ce75b3ea8686", "comment": "Malware payload (Rhadamanthys)", "value": "ba785e83dd30046ad84419c88776486f85feb1d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150592, "uuid": "cf4caf71-750f-4cfb-bf02-08b12b4526d8", "comment": "Malware payload (Rhadamanthys)", "value": "093d7a86ce00cf0f0791d4d7f384f29a4a5dafd537b659e0e9959cc4288f881885057a3c6d4d4516a7767c2fa5053d2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150592, "uuid": "4bcf6cd7-eeea-4630-9426-64a0b21a4f56", "value": "T1D5A30A44EC27BC3B14C25556BE48A4BA9DDCDC6C902BE67A6F8CF38246B4B143CB25C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150592, "uuid": "e5534a62-043e-45be-8d4c-c9b4e04b7c1b", "value": "768:GDhd0i7J4sYKgY/CMNfWd57LZ1VaZrXKar+QHb77HuZWTZAPAFbJOdUSLAuAAroU:GDB7eKg20RIrjr+Q72yA+0S6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150592, "uuid": "58eb8ce1-f974-40f9-b559-f14775ed0c61", "value": 102650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150592, "uuid": "1e19187b-0d69-4b13-8bde-d6c1e32a67b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150592, "uuid": "3d3c7434-8170-48b5-9b2d-7b1f320ab348", "value": "invoice-1637482117.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325be6e9-af58-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761145378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145378, "uuid": "5de99c88-547c-44d7-ad91-aa225cbb76cb", "comment": "Malware payload", "value": "3bd37346ab9ce3113c5c9ec7e0678757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145378, "uuid": "66745e04-d3dd-48b1-a1ba-ed7b44ad87e6", "comment": "Malware payload", "value": "dc050dfb01afc9f74b81e1eb807f1f16b55a5b27cf1c9429caaee49956833c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145378, "uuid": "7371d496-021f-43a0-a0fe-894ca8c29df9", "comment": "Malware payload", "value": "30dc1ca79488260b09a390d36607f01eada1d2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761145378, "uuid": "726fe889-b5d8-45fe-a37e-c47e0c3a1dfc", "comment": "Malware payload", "value": "592e76989dbc7039cfbdcf53c1d4cbdda57fad010782b3288ed8ad6782a6c047e1662c471063329b31ef0a4736a35445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145378, "uuid": "8b46fd77-c223-4453-b698-f9b8bb014873", "value": "T100044922B18491B9D95FC0B4C7525BB2B273B4880B3475EF07A006316F69FE5BB3CA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145378, "uuid": "95337023-a42a-4f16-9b2e-3d73a8b94ef7", "value": "6858097114808d4d1604faf3f6566890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145378, "uuid": "8814f30b-9d66-47cb-8127-2fe7abaae5cd", "value": "3072:R+NTcgRU3CdaibVHWdnLjDr07yiczY5HD11qzR+PNVnkbSWPqviaPevNGkbQcsor:R+ldnWPawTdHdEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761145378, "uuid": "10fb2060-9ec1-4e95-8fc2-75046f51c37d", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761145378, "uuid": "250a4bba-169e-4315-8ec4-95939ee5b7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761145378, "uuid": "1d6ab9e9-eb95-4308-b073-8a5faef2770a", "value": "index_win32_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cca33d-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130964, "uuid": "8414d00c-d6f0-4027-aaa6-12c9585945bb", "comment": "Malware payload (Mirai)", "value": "a0422260a1fccea172b6284803b8577b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130964, "uuid": "95de6901-6a2f-4dc1-8351-66fd79057dd6", "comment": "Malware payload (Mirai)", "value": "dc2c46290da81d4c9b4bab396351f5d3064f0dcf589030b6c8445fe924b8cea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130964, "uuid": "5dfde5ef-9dcc-4b34-81b8-8693f77b8753", "comment": "Malware payload (Mirai)", "value": "31bcb609880a4df90c960184ab8c7ad840e74546", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130964, "uuid": "12ceffa3-c6d9-4a80-bbb2-67b6300a4d6f", "comment": "Malware payload (Mirai)", "value": "43af740eed57977bfd98aff79ad37cdb7a1f77d45c04782fd50287c241a77ddc8f7b0f5ec27033aae29857cd0e490337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130964, "uuid": "320bfd5a-ea6f-4b89-a728-c7f07afa1742", "value": "T17063961D7E218FEDFAAD423447B78E21AA5823D627D1D5C4E19CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130964, "uuid": "f2b9fd08-87cc-4831-982a-2d14ca0b78f2", "value": "1536:i0y4avH6PTn/m9cf2j7mBgL+0jRb+10Wuk:ihSrSmKL+oReJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130964, "uuid": "9db3d546-b4b6-42e6-b8b5-630f8bd0f0a1", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130964, "uuid": "20e0d49e-5ae7-4ad7-a188-31039df7b5e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130964, "uuid": "76b80bf0-8460-4ae7-9fe8-5b9a01a6d532", "value": "botx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84e717f-af85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761164984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164984, "uuid": "efbc3f3c-5167-4d28-8c64-75df4150daa3", "comment": "Malware payload (Mirai)", "value": "d9a767ff73b7283bcc9a84c57b97ee8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164984, "uuid": "df150c89-8722-4b98-9476-90a55e8d14a4", "comment": "Malware payload (Mirai)", "value": "dddd12cea3a0b0e451794a9ebce3ffa47b908eb38ded17adba1cd16aff11b393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164984, "uuid": "5975c366-4b2e-42b3-9cdb-e1948ae5e884", "comment": "Malware payload (Mirai)", "value": "7537791bd6ec57c0a87f3527305d7c9c51c9aa15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761164984, "uuid": "2e031ae4-c7e5-41ed-be3a-bc693f56d022", "comment": "Malware payload (Mirai)", "value": "ae20260307e95be578ce7a0905b08d3d1dd949006def0873d1e9a546ed38936fe1651d8f804dbaebd2d72ed455f34d06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164984, "uuid": "90506faa-a8e0-416b-b7b6-9b8211d874a2", "value": "T1E2C3C81E6E229FBDF759823047F78E25975833C627E1C585E2ACD6102E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164984, "uuid": "ae5379c8-eeac-4121-b16c-098c1fe7a70a", "value": "1536:5eVxVNOugg1gILI7hvk3+y0/c2CL4x6zAX0/bGAPQxeOFTxMkfFI:kVNjgDd/c74x6zAGGAIvMkfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761164984, "uuid": "8d239039-65f6-400b-976a-340790d61f30", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761164984, "uuid": "cbb450d8-ca8e-4961-b1ae-5f63032bbb4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761164984, "uuid": "9f9b1e3f-ae19-42be-adbd-782f819ce3f1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a25d4b-af1b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761119208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761119208, "uuid": "ca89a70a-10f2-4248-be19-0f90bb971044", "comment": "Malware payload (Mirai)", "value": "c06d0dddd7734e036ec1f2c444d89477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761119208, "uuid": "72442275-87d4-47ff-8c25-78558f9a83cb", "comment": "Malware payload (Mirai)", "value": "de50b804b0f1b55f4b70e66dc4c5873d179b03b0f584493ca9a0f37163f3808b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761119208, "uuid": "502a20b7-7b13-4c06-9d82-29d8e5537f6b", "comment": "Malware payload (Mirai)", "value": "a54f6560f1a96cc323b5190e0c0c9843025334ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761119208, "uuid": "4d358080-f25e-46e4-a40a-1a171206d15d", "comment": "Malware payload (Mirai)", "value": "0f94b274a687f4ee73e2956accfd789483baa7fab035d044e43cb10d1d779bca2f62a9e742c29e8f5a187a008fd10e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761119208, "uuid": "a71fa37b-a1c5-4e10-ade2-3a76ef9ef3d6", "value": "T1A773280372180F13C46309B0253F1BE08BBAEDE625E1B585A95FAEE54A31DB71186FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761119208, "uuid": "26dc9943-bd3d-4398-90e0-749e54c56b63", "value": "1536:8dyxKXETVdZwa9zZx3Z2gBruqUoL07dhQz22a:8bEHZhzZxJV/UD7dhQz2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761119208, "uuid": "1cbecf02-2e08-4b34-8517-6313130a56cd", "value": 74120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761119208, "uuid": "b8d4b4d2-d299-4fbb-a117-c817e019669a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761119208, "uuid": "29c0a1f5-a468-4fd7-a4f7-809d2a83faf2", "value": "kwari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f041a1-af9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761174033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174033, "uuid": "91ac06cd-5561-4190-b4c7-b1d60f9552de", "comment": "Malware payload (Mirai)", "value": "44391879c8cd103f50540776c0fbfbfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174033, "uuid": "ccc8af40-c807-4521-a3f8-0bdaf3190db8", "comment": "Malware payload (Mirai)", "value": "dfd02ed59c95575642af97a5a34c18ec7be4a61872e339720bba3286d6dbc80d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174033, "uuid": "6858b3b9-0d37-486d-a563-d2285a84b7b6", "comment": "Malware payload (Mirai)", "value": "1bd93500cddc5b218df6ee5f944575eae6dc4d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761174033, "uuid": "f255700a-01fc-4b7a-918c-6acb45a6e99a", "comment": "Malware payload (Mirai)", "value": "92a1e6e78ff281d55eb67aac032f587e5ba61299a802040d54ddf28f0a9bacf47f97b0f78287d579b4860c4a445ac9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174033, "uuid": "35a37b9a-ee43-4822-a36b-b73505696d6a", "value": "T17823F128F1036C43C8229977E17D61CE7A0535BA67CB2C002A654D2DBAE639347FE45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174033, "uuid": "3798ae82-7a42-41ac-b21e-020f2f046bae", "value": "768:OkXsan8kAZvGKG5jiRNo/BkmehwwrGrWvO38ldkRrSxW25bi9q3UELfB:OkX78kAZuKujRkme5rhvflIsj5bXLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761174033, "uuid": "07490478-3036-4a63-b20e-fea724c2485a", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761174033, "uuid": "56ce43d1-ee86-4256-b40c-c73c4c5c150c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761174033, "uuid": "c11e67f5-350f-4d5f-9949-46995d54d82f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9d143b-af91-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761169960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169960, "uuid": "b142ac0c-9f09-4cb7-9f83-afe52b4e25d6", "comment": "Malware payload", "value": "058a2ffdf0fed954ee607e3a664a1349", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169960, "uuid": "cc7b422e-442e-4e95-972c-734dee37325e", "comment": "Malware payload", "value": "dfebda79a6979264ad03047242f1f18b7085baee5e069c00179820d0327fc9ab", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169960, "uuid": "29561878-b8e9-46c6-b76b-5d6d3b3d972c", "comment": "Malware payload", "value": "75984941bd3c1fd2cb7160f6637bb6181e9be039", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761169960, "uuid": "4a93af1b-84fe-420a-8fd4-e443cae20413", "comment": "Malware payload", "value": "bf5a684ba0c5594420d1164d8778866116a394f740686f0a15e260ab15e9ee6593decaf0704498a7cb77e1c958fb8f3d", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169960, "uuid": "1dc3d8e7-f1a0-4f43-a687-29fccb721ab5", "value": "T112865AD5B81E3822D5C977396B664299723CBC089F91C22B2504BF6DADF23548F33B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169960, "uuid": "b174c462-e926-4281-8048-544c110d043a", "value": "98304:lhqRtygLcaaCaJJIMnubWh113PZJdElAyv:lMRtygLc1JmbWxPy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761169960, "uuid": "d679fc2f-2406-4710-bcd9-445850bfd2e9", "value": 8034050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761169960, "uuid": "ae91f8d0-f6f5-4da9-9124-9fe3f17f4194", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761169960, "uuid": "914fbf51-74fc-442a-b575-fe243270d22c", "value": "058a2ffdf0fed954ee607e3a664a1349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0ee43f-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135677, "uuid": "ca7e1c94-400b-43c4-baf3-786180e138bc", "comment": "Malware payload", "value": "f20ae6b66a238838551f066017beb3d6", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135677, "uuid": "42818b34-79ad-4da5-939b-c078f32b2035", "comment": "Malware payload", "value": "dffc2ab5e0edf148b342ffd737c3c88c3ddd0cc40997c86769f953eda8633c5a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135677, "uuid": "dd5250da-a7bd-48e7-8144-e45af6cd66e9", "comment": "Malware payload", "value": "cee12ed92174e2f0ef9fa96c2e0869093186dbf3", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135677, "uuid": "666b84f9-5503-4902-a9c0-249fadaf54b9", "comment": "Malware payload", "value": "6408a99827803ff57495a3937473e6945670682a03b415f18b0fe64f454817970b0eb3542cbc0f6d9fa4464ea3a18a8a", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135677, "uuid": "d1851efa-c1c6-41f3-aff6-420e27b6b0f6", "value": "T1EF25125BEFE0F71BC42064F449C3C4C4112D6EABB66D070B2B04BB4669B56F2B5C58AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135677, "uuid": "3b8355d7-882f-413a-ab96-b77632605e2f", "value": "24576:rG+Jk3+nYo1SzNxaaOpZiOUINZjGeBTwK3uSf4t:rGzqH1ya6YqeB33u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135677, "uuid": "ccf76ae9-a5a4-40e6-a58d-10c674120be1", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135677, "uuid": "fd608315-c962-4e1f-afe4-9a508d87c246", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135677, "uuid": "fdef982e-e300-4b4b-8f2b-ab87ab23ee61", "value": "Po docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5567c954-af46-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761137706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137706, "uuid": "efaf49fc-2002-4551-8d07-2fe2f7092e55", "comment": "Malware payload (RemcosRAT)", "value": "c411aec98a1fa1c05988f85477abee76", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137706, "uuid": "e0e01bf5-ee55-4a2d-8ac4-cb708c465d4e", "comment": "Malware payload (RemcosRAT)", "value": "e007c641b8afa7128cc9117f0b33f80de1656fd09833a38867e6956f9ad18ec8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137706, "uuid": "f68562ee-151c-4122-819b-629387b70156", "comment": "Malware payload (RemcosRAT)", "value": "d3236d3caf8c82efe3eee3eafe64818ca733bc73", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137706, "uuid": "10edd8ad-af91-4486-bfc3-d9296e6c7ac8", "comment": "Malware payload (RemcosRAT)", "value": "7a8b820b76ca89606a48d31f22655ec940289548415e2ce5bd4696123787072a439ff323e29dfc1af7ef00b1c230bf39", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137706, "uuid": "6693dc05-14d3-4630-9c00-4c7406fbe204", "value": "T11A06AFBC76047DD6267F576BDA96ADDC03B626239ACBA4CC8064B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137706, "uuid": "f6ab2cb1-9f7c-4b09-881c-e82e1234d0a4", "value": "24576:OXrPld2rvNOYFirOxjWtUwbmcL2fxibtb8S+ypCL34UNEdc3ldVK7tgaPV/5dxmc:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137706, "uuid": "c32c2e0d-e043-477f-9c5b-96ba9ace271e", "value": 4004774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137706, "uuid": "446b01ff-c1db-49a3-a12a-06335f3252d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137706, "uuid": "87077133-9367-4f9f-9809-c8d90cd584e5", "value": "kent.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb62185-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150494, "uuid": "90b16ace-b650-4d55-bf8d-6ede4a2ce19f", "comment": "Malware payload (Rhadamanthys)", "value": "14b3c49df3c87226eb60e4bb209e53ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150494, "uuid": "6be5d177-095b-45b5-a8dc-7e649c8b0aaa", "comment": "Malware payload (Rhadamanthys)", "value": "e00c3dadcf053f8541e93b2b6a7eaa18dd91df8cb6f7d336b76d9db20cd2d4b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150494, "uuid": "9eb14c2b-df5f-4116-b353-b995a9e2e374", "comment": "Malware payload (Rhadamanthys)", "value": "829effb1c36212ec1184b8a180c59a5d764767fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150494, "uuid": "47ca303c-cb08-4998-9c6b-fdd3ca8d957d", "comment": "Malware payload (Rhadamanthys)", "value": "133d22c36bf4a8b1661017d69acba3d9c85caf312930052baf9e4da5ca3fefdae0ab078a321a437155359047126a0a74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150494, "uuid": "c9457f63-23db-4366-b204-38177a13c95a", "value": "T1A6A31C6C6B117CDD09EDB2BE5A2620F2926701C2E25839988D7EF3D5188FD1F3B944C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150494, "uuid": "5f6a0bc6-6442-4308-becc-d9f80b17b924", "value": "1536:GDB7eKg200OrHrovf0vwAVB/6BkQWJ+aY:GDB7b00ULoMv1B/6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150494, "uuid": "1f65db98-64dc-4e4c-8d58-036d68ff3b87", "value": 104040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150494, "uuid": "a992bbbf-9a7a-46f5-81ec-d33f29312033", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150494, "uuid": "c3351880-0bec-4b2d-866a-823eb3569263", "value": "invoice-1637482117.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3e16e6-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761121183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121183, "uuid": "23c88b34-869d-4cf4-b033-687ca2f143c0", "comment": "Malware payload (PureLogsStealer)", "value": "1b145d2fcb00dc1696d8b0930c3a06d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121183, "uuid": "73da8208-18b8-49bd-baed-2d7f6ff335c6", "comment": "Malware payload (PureLogsStealer)", "value": "e070393569fba5a88a1ee4cb626b76d58e48d009c20bce0743ebd74555a9b2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121183, "uuid": "eb28ea34-f1e0-4db3-8718-f5991dbf6e7e", "comment": "Malware payload (PureLogsStealer)", "value": "09ef5e2b65dca4fbed7e606ace35a52310cf35eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121183, "uuid": "c60c79c7-7678-48e9-b924-e9f5fb4e7864", "comment": "Malware payload (PureLogsStealer)", "value": "6a2731c00efb645ea324138829b79f406cfde7935abd235703e57be3b246eb4ac39a1db4aeab2ca918bba4de6ad23287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121183, "uuid": "07fb4249-1150-4b1f-b4b6-443d16fc6a64", "value": "T1433501AC7215F99FCD87D4708DA4DE74A2206D6AD70A811386E71CDBB91CE86AE140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121183, "uuid": "ac6f02fd-b6b7-4019-b0c6-f46628db0efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121183, "uuid": "cdfd4876-b52e-4f6f-8aa9-1f8a24c9624b", "value": "24576:8edYxk4kqdglCSJJuI7XknFeMCPZxnap+:8edfXqdzSJJuI7XknrCPZxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761121183, "uuid": "4f184199-c829-4b77-b736-d4c7b19b6e8f", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761121183, "uuid": "f3c73036-1dd9-4f3e-9133-56d54faae360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121183, "uuid": "0dbbb6de-d7dd-4809-adec-fa99cb8b79a4", "value": "csio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7e9b85-af08-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761111336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111336, "uuid": "f835bf3b-6112-4d74-b94e-cc2d44ec83bd", "comment": "Malware payload", "value": "80c419739616c96e8156fc820c5fd56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111336, "uuid": "7a8c1e47-5fa9-415b-a3c9-a4c97ef6fb6b", "comment": "Malware payload", "value": "e32b50bbfac3531e4411b9ac92a9082476b50f8809e50aae9a334582f04fb8e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111336, "uuid": "2d671fb1-99cf-4b09-b0c4-39bf68dc6a1b", "comment": "Malware payload", "value": "c3e2fac19255d0479553dc73731ccc60aa38aa22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111336, "uuid": "a5f90689-9d86-4514-bf49-5c90a7225c82", "comment": "Malware payload", "value": "fc6a9d1a01fa8cd7a73bdcc91535c7cac1ef5f1c89dc7065044b389646f49b07a9ea0ca57ea3c4d87c58541b27c0d662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111336, "uuid": "c440817f-61c5-4a44-acf0-999d9760bceb", "value": "T17C463947ECA555E8C0AED63086669253BA717C494F3063D33B60F7782F76BD0AAB9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111336, "uuid": "7d074876-21fa-42d7-bea4-41712e00b45f", "value": "49152:uBiXb9hDWF4wAinLyjUHvodBFKZ6aPPxvk5EHYuzxPDGP/2xt7Td4KgKCtyofADx:fDUjxKI5+EVoKmFox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111336, "uuid": "7965d19c-9d60-412b-8fd0-a7c96f0215c7", "value": 5812376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111336, "uuid": "a91988f9-a27e-47f2-9e90-4ebeb16c2366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111336, "uuid": "06b03fa0-009c-4d87-81df-7ebecc32951d", "value": "dbus-daemon.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faa5eb7-af49-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1761138985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138985, "uuid": "e1318158-74ed-4dae-931c-b1caa3bc73e6", "comment": "Malware payload (DarkCloud)", "value": "77b69f4126547ffb9d781ea15dbc8dd0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138985, "uuid": "53196cfe-9d0d-4e4f-8fbe-c94753ceb51f", "comment": "Malware payload (DarkCloud)", "value": "e3db420ac4254fcdeeafaf59de464173c6ea98ce7cf38cb9441166848fe8835d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138985, "uuid": "39d244db-8e1f-4e5f-a41d-b67d60c68f6c", "comment": "Malware payload (DarkCloud)", "value": "a0df6733e19954fd7913b667f7d1d4dbce9290e7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138985, "uuid": "c4d3a0e1-d08c-4e9b-9be5-3a29eb9d7327", "comment": "Malware payload (DarkCloud)", "value": "171f6d8b1214320e3361c2e9555852b2c02bfd0a40c51c51e73e8148f82bb97d67f99d22666d3afd735f484b9a2edd25", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138985, "uuid": "120a203a-4def-4428-a268-64cca7a3db55", "value": "T102B2D042991D7C99E7EDF3AB2D9B4094339056E012DC8664DBA67CF20D22D132DC770C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138985, "uuid": "e534a9bf-99a2-4a90-89b2-ca9c28d1b725", "value": "768:TDuWbqRTj6VLzAOMJzL8yLFhOrHvwpj21QNay:PEpyLi88QKaHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138985, "uuid": "2affd5d5-5fe9-4d04-8a26-ec5cbc4b6aed", "value": 25001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138985, "uuid": "7c2abbaa-800d-43b5-a1b9-21ba68511054", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138985, "uuid": "1110d611-0acf-4137-b83d-6698fe9d70a0", "value": "BOQ-RFQ-PO_079800_CBEX296980_PR10486_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08a44f7-af47-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761138315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138315, "uuid": "6436b84c-2309-4d93-b432-2a9755442740", "comment": "Malware payload", "value": "316e9406af7e95fd378c4d78532b5873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138315, "uuid": "93e8ef55-0b88-486b-b5bb-1f3df93ef41f", "comment": "Malware payload", "value": "e430b9198900ed96cfb3465dd90d9b856a5059ba260a0a07572692d8a069c9e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138315, "uuid": "3fe80a8a-59b3-45ce-aad4-aed554169b31", "comment": "Malware payload", "value": "eb951713eac47144b2443ef1a1e968cb72c2831f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761138315, "uuid": "3a92cc00-c531-4c2a-8ad3-aecabb0fe082", "comment": "Malware payload", "value": "2914339ba150c88abf1fdc43b4daa26a78b90971660343f42247adef4eca9cee4418ed8a70c9bcf9582a0439b98dcd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138315, "uuid": "f886ea73-f179-4ba3-9f0b-9a28ba641330", "value": "T163E4125C6B0FCC53D9D52BB55E60E3B262389E58E911C2078BFDBDEB7069F19284C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138315, "uuid": "96043d69-15b4-4102-bd21-d79069050076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138315, "uuid": "2a4afbb7-c7f1-41bb-b34f-e9ca9ffc7158", "value": "12288:uWX+0LbWB9m9fdAvW8ijoZOxdLhFNMHzdNkOY5Y:vX9IuSvW8iMZOxtOT38Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761138315, "uuid": "9b61d5a6-a2c9-4108-9c24-70dc7cb9c201", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761138315, "uuid": "1f78836a-69be-48fa-acdb-aaaeb0daabad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761138315, "uuid": "e93ec638-b268-4fa3-a576-abcfc31d7f7c", "value": "Dekont_21102025-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472b8942-af20-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761121361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121361, "uuid": "e23306f6-28a9-4cc3-89dd-2bfba33064b3", "comment": "Malware payload", "value": "e96172eec7c451fd6900a78b254f53f3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121361, "uuid": "fd60f445-bf1f-4fb9-afc3-6c1faf692715", "comment": "Malware payload", "value": "e444235d724ef3b01a7f994af95d6f64027803048bc3e5f3e7e8542dfb705416", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121361, "uuid": "6668613d-87f6-421a-adf2-11456dbfd644", "comment": "Malware payload", "value": "0f3dd04b03752aa2a1ce8d4f3752706fe0baedad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761121361, "uuid": "0dfd9a07-31fd-41f5-9d71-8d9bbc631470", "comment": "Malware payload", "value": "c60ba60bada750875c938f242ed98f9ec16bf90df3a474b3819904085f43aba37effd09af2e78af0064b147a5bda2c92", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121361, "uuid": "137ec6dd-9421-4376-98b2-0b41a85ed696", "value": "T165439B89D78F41A5CF54A67B031A0A4986FCB73EF20511B530AC433537EDD2E48AA9BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121361, "uuid": "778ad60c-9fcc-48ff-8364-78dba2878d7a", "value": "768:GhF/Np+UNErjTJfrF/sGj/PZ5w1k8FIC8:c+UNYfrFvj/PZO1HFIC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761121361, "uuid": "5ec8484c-c187-4367-a56e-6c25b8342bd8", "value": 58577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761121361, "uuid": "a4bead6b-46ac-43b1-a4af-64bbaa948cc4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761121361, "uuid": "b5e31d42-b476-4b0f-9f84-a63dc81a5a69", "value": "sdo09ewsdf023jfkjsdxc0vxc90sd9f3f9df90cxv9x0vsfjsdkfj090xc00sfsd399sdf00xcv0xv0e90w.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f76d329-af0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1761112329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112329, "uuid": "a4b9484e-2bed-4148-b3f9-7d769211d40b", "comment": "Malware payload (Sliver)", "value": "9f49d77669771649261397934f1b806b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112329, "uuid": "2b38b4eb-e6ff-4fb7-99ef-9b338e803378", "comment": "Malware payload (Sliver)", "value": "e53c0efe8c2d59686b59d6b14ef465eb2af1119af3cff6e4a7e1050f08fff07e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112329, "uuid": "55973161-c660-469e-9a9f-5b1e7b0ee606", "comment": "Malware payload (Sliver)", "value": "361af7dcd3b72820c0beabfaca2c19d2dc726141", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112329, "uuid": "6142c8dc-c8a8-40c2-8e7f-9e233293bdad", "comment": "Malware payload (Sliver)", "value": "3e5b6628ca4aca5265ff7a33bf03998fbc6999858f7f4025b2a74c4bdbe4054c94a7258a6508ebb407dac5063b5a9104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112329, "uuid": "327c3c32-79d9-4f71-836c-22b99ffa7db6", "value": "T14DE61A03F8D511D9C4E9D1B489254262FA71785C0B7933DB6BA1F7B42B32BE05EBA780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112329, "uuid": "c71689a3-a17a-4dff-aa33-20f72facaa25", "value": "98304:gcxJZBIrbI3rzOxliTb4YIrck59/Eg9o2PN9zP2:gwJgrjxkTDIrb59cgDTzP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112329, "uuid": "20a6409e-0164-4b85-8e3f-fffb7f5bc1d8", "value": 14213120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112329, "uuid": "0b1733d7-24b0-48b6-aa52-bc83176dcd9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112329, "uuid": "b65eeb68-d1e8-4dc2-90dc-18d3a0091526", "value": "LUCKY_ISSUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a215cf07-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130963, "uuid": "37dc5b0f-4024-4b81-9f1c-163b3b900a62", "comment": "Malware payload (Mirai)", "value": "25b788483acba72d41aeee02127520d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130963, "uuid": "46a187f8-f892-4ab5-99b6-6fbd0fedab62", "comment": "Malware payload (Mirai)", "value": "e6a6c98c99aa584b265c2067b1142423605079283a48f45f977a128d4614924c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130963, "uuid": "b4dac48a-99e0-441f-afda-78f888d3a0ab", "comment": "Malware payload (Mirai)", "value": "6dcd01be1c139dd88b5b89ca81d04e316eda19c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130963, "uuid": "5b3623db-d0d6-4589-b46e-992c5eeb74ae", "comment": "Malware payload (Mirai)", "value": "41e53c6a8f68403eff582d9b7c631d092fde9c4db64928737c1792c88bd7d1b5116423a5c4cdfa6028601c7891f03637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130963, "uuid": "b5d7a581-69ea-4859-817f-de39b5b77b84", "value": "T118631856F8818F15C4D502BAFE1E154E371717E8E2DFB2139E206F603B8A56B0E2BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130963, "uuid": "7ae23394-6a64-41ff-85aa-e5836863e1dc", "value": "1536:9/nO1aCTYOgTBo3ruozK+MazjTQlMJiGV5l3BmOb+10mG:4a0Y5to1W+BBV5l3BmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130963, "uuid": "a4d2a699-eb6c-4000-9199-2f3e9909e041", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130963, "uuid": "95b23cc4-2fe4-4bb5-a755-e7add1397dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130963, "uuid": "af27e7b9-8062-48ce-880d-524078a70772", "value": "botx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18142c26-af97-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172392, "uuid": "07661431-8cc4-4177-bc6b-e1b116f0b830", "comment": "Malware payload (Mirai)", "value": "157945bf47024d3a661782f692565e01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172392, "uuid": "d10f4099-bfc3-4c5f-86cc-1d9f395f6519", "comment": "Malware payload (Mirai)", "value": "e789356fa1e41933919d8e2e4890fb6df4059e538e5394d489ab89f7d6afb6c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172392, "uuid": "e1bbb285-b277-415a-b9aa-f650598a9473", "comment": "Malware payload (Mirai)", "value": "0006978c40d1eac5a4425859ef468621239dc15a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172392, "uuid": "6715d7fd-2aa2-4f19-bf9d-f829a8e8b6ca", "comment": "Malware payload (Mirai)", "value": "1a626c1dcabef4e72fe2fbd7d9d4d33cc973f466a11f4380d4ffe10bf9fe5c721d883eb946e499933ffadd4436b64919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172392, "uuid": "cad340ed-898c-4fcc-a0e6-198176cca8a7", "value": "T142737C23F80A8FA1C01601B0A4E65D751F13FA9F4A532DF3EDA68AE154179E8B509FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172392, "uuid": "0e7d817c-06a4-46a9-8868-0c635ca1f40d", "value": "1536:Panv/NBtAf4OR371DUAbWwR9ui38U2I263nhC8/dhQzqsY:P2OhhDUAbWwrlt2l63nhVdhQzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172392, "uuid": "6d09b623-d260-4219-bb7c-cdca5b89ca25", "value": 76668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172392, "uuid": "ee88a191-f942-4cde-b111-6f58330764db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172392, "uuid": "25271fbc-ac23-43bf-bb41-7fbd9b332597", "value": "kwari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc622d9-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150576, "uuid": "60bed7f3-42c4-49f1-bd36-affa754b3e1d", "comment": "Malware payload (Rhadamanthys)", "value": "d7779952c2f2ca6d6d523b28de72a9c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150576, "uuid": "5ed2aa1f-6c91-40ee-9038-7a1c41f8d721", "comment": "Malware payload (Rhadamanthys)", "value": "e7d294ec61cdfbddfc8b91bd85966bbd6881ad296c3225d9b6aee4e94059dc57", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150576, "uuid": "b2cb2e67-603d-4420-b562-79194c52c4b7", "comment": "Malware payload (Rhadamanthys)", "value": "bc5416dd3854a1799f517eb44bead82d2fa07f55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150576, "uuid": "e7b5f3b3-602d-4065-acd8-ced5da218f31", "comment": "Malware payload (Rhadamanthys)", "value": "2cb69fe8e075218076a7745d3b36422e6e8287d1cf79028b32d91ba9ec3a55c175a805bc55fbf3186426412bdb709753", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150576, "uuid": "c4ef2acc-3359-4dee-9eb0-1201a2917a32", "value": "T14AA3F75907E09EB138A896B73E838DEBC90D8DC56F44F34D35ABAA9570D475A2C01EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150576, "uuid": "f259d211-c829-4d64-88c7-f0c180ae4dab", "value": "3072:GDB7b04F85ELY3MEduGd1F8E3EcRBRDgiL350w5tmndZwKTbKejiW442fC4dz77H:05F85ELY3MEduGd1F8E3EcRBRDgiL35f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150576, "uuid": "53cc6859-f6e5-47be-af5b-be68c701bd39", "value": 102053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150576, "uuid": "ec9652de-c8e1-4061-af7e-c49bfe156592", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150576, "uuid": "57fce48b-9f42-41e0-8285-2bf0f05174b7", "value": "invoice-1637482117.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1a6ed7-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173228, "uuid": "9a4e76ce-2c07-49b3-a038-b82f20ab9a17", "comment": "Malware payload (Mirai)", "value": "7a65e44bd8949be76e1ecebd7591e583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173228, "uuid": "3b7f3ef4-d3d1-4cc6-b516-aa4d4f60d9f2", "comment": "Malware payload (Mirai)", "value": "e8a28b19dd1661862aca3f278b496bb6ed82fc25bfe603e3bb38fe5b2b008192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173228, "uuid": "0773a88a-930d-46fb-a8fe-4cf13767da3c", "comment": "Malware payload (Mirai)", "value": "fc4e72667521440525e1439641dc48d30c8c4a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173228, "uuid": "b761a591-0db2-4cef-a8fb-9597495da7c8", "comment": "Malware payload (Mirai)", "value": "b3e7d43dcb11de07609f9f37ffc8a1dfb51d21723cd3b748e35ffef1cf4598450dfc20039b04c140ed1037235ca23843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173228, "uuid": "f708db25-81b7-4582-b970-5998db54a990", "value": "T12C6302BD3DB52693D7306FF17378DAC103BC93F854D026756AB0AA7A012A6900EED593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173228, "uuid": "31a64245-e9d2-4a73-a14e-82d20ad9e6e0", "value": "1536:OjSu3ncYlVGOpEhuRE6cRYoD2kS7sNzcugOkZvP4IA9EiUzD:K3nDVUue6cRaklNQugOMBBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173228, "uuid": "9165ecf1-60ae-48e0-9c55-b44edbe650ae", "value": 72356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173228, "uuid": "448f05a5-68ba-409d-9a8e-eb8981e5f5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173228, "uuid": "bba0a43a-734a-43da-8681-144816c39de4", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acf2a24-af3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761132615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132615, "uuid": "68c854d9-68b2-4992-a60d-3adf7c23714a", "comment": "Malware payload (XWorm)", "value": "09e408f700d70ee4a2f23797d782af95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132615, "uuid": "f19acd97-4e7e-42a0-a4ff-7878385a231a", "comment": "Malware payload (XWorm)", "value": "e8a4e365626b132abb5a8ae04322b88061994f3ed7e8a6d2613370e3407af90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132615, "uuid": "6ab6fa22-3ee3-46b4-ac26-52ce7b76cc7b", "comment": "Malware payload (XWorm)", "value": "8a75f686269274c03d8ae03b194d991ff82d8d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761132615, "uuid": "7d390a92-3290-44d9-aa4a-d805b8dad67e", "comment": "Malware payload (XWorm)", "value": "39381c1fa3a107f89f9ecfcf4a6f9956379e9a97e317c8e6f406b82664dd96202c7083c0120ab48b62c0913dd2d5d81c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132615, "uuid": "79b81003-6942-4eff-ba71-d66569876b38", "value": "T1BB534D00734C86D1C6ADFAF5F862917152F4BF069C13A24B2495B6CAFA3664F4903F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132615, "uuid": "0dd65478-60ea-4fc5-b8cc-5f1a88b4171c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132615, "uuid": "3a32ba36-abc1-44df-af1b-9fbbf98ceeb3", "value": "768:cIS81kJqdDXaDyC/YVFye9F8OjhayyErTr5:cIZNaD/mFb9F8OjEqH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761132615, "uuid": "3b7be40c-88a5-4f63-aa54-aac77e2a5fb3", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761132615, "uuid": "b44d255a-9432-484b-a1b4-088d62b2690c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761132615, "uuid": "ef0d1ed8-9144-4b6f-9399-f8c81e9326c6", "value": "09e408f700d70ee4a2f23797d782af95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9154608-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761134947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134947, "uuid": "de2b7bee-8b30-401b-ab9f-5373d8fac7a5", "comment": "Malware payload (RemcosRAT)", "value": "2f895a88a96d4806f06a1c5903555931", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134947, "uuid": "cc7d15e2-06ef-40a8-bed4-b465501d91bf", "comment": "Malware payload (RemcosRAT)", "value": "e8c3f89b4be76e795905b094a661a56ff0338ddb4f9ddc1510416d880be247a4", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134947, "uuid": "8354d4d4-956e-443a-8761-03c65875a49d", "comment": "Malware payload (RemcosRAT)", "value": "2d3cece54f87bcc42a528516a5922efe157d1bb5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134947, "uuid": "dc2fee1c-93ec-4179-9d70-335fa5237a28", "comment": "Malware payload (RemcosRAT)", "value": "7d089c93383117ac0a40f6708de4c03f1b58093d115f5885f470bd732bd03878f3d2b4f9db7a16d80f5a4d38ade0703e", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134947, "uuid": "1ff56c36-dd80-4430-b4ca-36de702e8353", "value": "T1AF2629F237DF7A4B5A05735AA44D29580F5FC4241E83B6D890DB0BD8540F89B2AD0EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134947, "uuid": "d66a1b16-683e-4569-bae0-2a648a805440", "value": "49152:xjIbhyUirKsWN98LtP0XdOz7YZ7SzZjTJuzEsCn/APv8nJ1wiV1ob5LKRRo4BLrf:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134947, "uuid": "990dccbf-befb-47bf-84f3-c2de7b79889f", "value": 4434944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134947, "uuid": "349062f2-d4d6-42f3-961c-441aef49b7df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134947, "uuid": "f10f1682-151f-4484-a015-78bee768e121", "value": "BASE.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918c58fb-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761113325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113325, "uuid": "d934f537-3243-41a6-b582-2fbef11c0780", "comment": "Malware payload (Formbook)", "value": "cf07ef9e5dc0a7c386637974c9733cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113325, "uuid": "729e3263-2287-46f1-9bc3-7dda391259b9", "comment": "Malware payload (Formbook)", "value": "e8f58969694b57552d15189f2942b202b57f90d23ae9e068ae7db0e086ee31a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113325, "uuid": "6fcafa40-4952-44e7-a16a-241db9c648c3", "comment": "Malware payload (Formbook)", "value": "5e0c9133eca9b424624b761a27f3812df827704e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113325, "uuid": "8b642659-5592-45b0-92fa-4839cc3c951a", "comment": "Malware payload (Formbook)", "value": "2a21faba88811b9f5f1a7e3f38602e0f453cac398473ee93162adc1a3ebb2307647aa5d0669b81f657e4f389c1daedfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113325, "uuid": "05a88a7b-67e2-4688-b31e-92209753c490", "value": "T18A05124CFA7ABB7DC86C4F7A8123694800F08167E076F26759D504E31B29F89898BF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113325, "uuid": "49f47f74-1219-4748-926a-899f21582d4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113325, "uuid": "a7d8810d-56f4-4e8f-b704-1441543f5f68", "value": "12288:P55Wo7k8EExpiQ9DB4Dsq22R3z5HeT4zJt4XiZxT6gV/EeK3iddSoxVXPXy9jbga:2YiqDB4DF2u3z75xT6y/FK3idtx5PXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113325, "uuid": "5c569d2f-8482-4be2-b4f4-ab70b2987c91", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113325, "uuid": "e5342f9c-d4b2-4e29-8371-435f644d8266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113325, "uuid": "e0258112-2f8f-48be-9f1d-4c747d09601d", "value": "Q753256879877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f795eb4-af3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761134797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134797, "uuid": "1cdc2aba-c2c6-4ddb-992a-4361f5a159ae", "comment": "Malware payload (Rhadamanthys)", "value": "0ad1ee024949149737edc49f83520d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134797, "uuid": "78482156-392b-4b9c-af4b-6e3b86bc9194", "comment": "Malware payload (Rhadamanthys)", "value": "ea99f0edcfd429bdbd696ca66cdf0ba8a006ce028900a0e010b6b5a492eeffcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134797, "uuid": "8cd8a3cc-7107-4153-903c-214d42e5d650", "comment": "Malware payload (Rhadamanthys)", "value": "09ffa9bab53286f9b0abd73137f75f57c0dd754c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134797, "uuid": "b63e246f-fe47-4bda-8518-74a32147875b", "comment": "Malware payload (Rhadamanthys)", "value": "97ce42e783bade5780e3e59996135f44b2cb5a0f4555bdb7f65aae6927f7d0fffa568f6fc6d7e779a1ed952b4a415a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134797, "uuid": "8f6c1ea1-507e-46d2-8720-ebaa5acf7a4c", "value": "T19975230C56E9259AFC799F3058F607438532BD941FB889EF22C885ED0E827D5B770B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134797, "uuid": "2ce45ca0-2f60-42a4-81a8-17c86f805786", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134797, "uuid": "57bf50da-be70-4b8c-ae13-f104799eafec", "value": "24576:TfG6WCeS4xlGDAjkv6pEe84ldG+/ESeS1rkUniu0s/ktsX+qFcql8gND2yO:6xTTGDAqUV84DG+cSJliBmzOqlZNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134797, "uuid": "06ee3757-e8ab-4226-8a78-c19ffb214140", "value": 1677424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134797, "uuid": "321e1623-6cd2-43f4-b7e9-4772b8cd09ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134797, "uuid": "175be40b-e501-4b49-9479-6bdbb5eb40ae", "value": "0ad1ee024949149737edc49f83520d1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a92d726-af57-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761144989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144989, "uuid": "1fe79c20-5d5c-426f-bfcb-599b3dd44093", "comment": "Malware payload", "value": "f79e38797996b3efd0626b756a4b8c2e", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144989, "uuid": "0b34dda7-20c2-45b1-a0ce-2e5bcb93706d", "comment": "Malware payload", "value": "eafeccc6925130db1ebc5150b8922bf3371ab94dbbc2d600d9cf7cd6849b056e", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144989, "uuid": "a183a33f-7043-4a20-9262-cbce8a5cc18e", "comment": "Malware payload", "value": "baa9a761be1d8fa421c305510522bb11381a9c00", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761144989, "uuid": "be1efa21-ab51-491e-8fc3-c4985729ae4d", "comment": "Malware payload", "value": "e40869bc1fe55965b33d7acd8697415cb8410d496d405c89023786f13968871c794918d294c92e0a5bfd03f4bd885d4e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144989, "uuid": "bd668507-d0a8-4822-bdaa-2e3d5eb93f94", "value": "T15B647D60B64CAC1EEACBF1BC8D4C4E91607BF4601525C15E7813A3ACE4677E5452BBB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144989, "uuid": "afaf4a14-a2d5-49f0-8624-a6edade71c77", "value": "6144:d55YcRbeSmV5+Vd59AC1DkVfIgmKHcph9qeoGBRv:d55YgbeMx1YBIgBe+eoGfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761144989, "uuid": "44bc8f3c-26c2-4778-8f49-5b36d79e858e", "value": 318448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761144989, "uuid": "37f51e5c-5e71-4b74-be5f-b18aae821596", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761144989, "uuid": "c946b9ee-16f0-44c8-a589-a9bc6ab3ce3d", "value": "index_darwin.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e000be-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150518, "uuid": "554a582f-97f7-4f29-94c8-9e34fc994a5b", "comment": "Malware payload (Rhadamanthys)", "value": "202d5cb8717ecbd48d1e60144de49e60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150518, "uuid": "1495b206-63f6-4fbe-94fd-b85d7296adb6", "comment": "Malware payload (Rhadamanthys)", "value": "ec2e43e354f7619c63c0220e27c4e2e64af81bd3ed596d074b357b856617c625", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150518, "uuid": "f86d5715-48dd-49db-bbf7-d815cc8ee38f", "comment": "Malware payload (Rhadamanthys)", "value": "d7d7a33e9cbc8b8855ee3756838000d1ca126dc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150518, "uuid": "7b9bc3c0-89be-41d4-8c84-58b5bb114837", "comment": "Malware payload (Rhadamanthys)", "value": "b9ed412b185a8fa202fd1731cd3c174b13155daedee088078f0647473f128359ac03d04343cdab0e391019c83105339a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150518, "uuid": "04550d4d-ad32-4271-bdf2-b6eca9d59f84", "value": "T143A3F9244B669FE126461FE11E8E45F6AC2F08D004E6BEF0DD1BE0A121D795E3D927E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150518, "uuid": "1ef2231b-a9c8-41e8-9934-376c661ac950", "value": "1536:GDB7eKg20MrZNrvrcWqZqC03adASjgZEa6BkQWJ+aY:GDB7b00Z1jPqMC03aljgZEa6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150518, "uuid": "06c7e633-ab32-49f8-a9ab-c8c3f12eeb6e", "value": 104742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150518, "uuid": "0a1c2739-07e4-4287-853b-7c493ee70343", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150518, "uuid": "0b54beb2-f52a-46d4-9561-8e473d6b1002", "value": "invoice-1637482117.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb35da2e-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761154734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154734, "uuid": "99ba49d9-94d7-42fa-82ee-5557f341a0ba", "comment": "Malware payload", "value": "fdc2a430e9438e2e9290c50cb82fe94b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154734, "uuid": "2338afc3-f5cd-4f4f-a459-3e9d19900c4d", "comment": "Malware payload", "value": "ec8c191ad171cf40461dc870b02f5c4e9904f9fec1191174d524b1fb3cbde47f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154734, "uuid": "66980588-f58d-4e84-9bc7-5c7351a994f3", "comment": "Malware payload", "value": "a5cbe5e99c4379db9ddfa1d1ce3c4f070feb8ddd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154734, "uuid": "f2c11e9a-6068-4a5b-9a37-a73830d521ad", "comment": "Malware payload", "value": "d8d98514c1a86805f6fd78498ecbbcfbe5eabf3ce1787a780116de5cab0b9f876a6d625ecd9f762f6d9ebad9aca62b27", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154734, "uuid": "43db6148-19a7-4d3f-8d33-a1dab8538348", "value": "T12893E2A06DCC60E17DB963C236A77488526B7554D8473CC67A8B19503E1BB093EFBC3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154734, "uuid": "652cc28a-6cc8-470b-8449-b0c1b2cde9f7", "value": "1536:32nAIZamjzt5aOIEEMNQ1vkZ5Lf2f++2+v2zEnUqcqF92LkuiXID4aJnqHfL3Lsc:GnjLhNBrgyeQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154734, "uuid": "025fd68c-00bc-4b90-9ecc-df095e7ebd65", "value": 96917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154734, "uuid": "d2651dfc-54ab-4618-bcb0-a1caa88955b2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154734, "uuid": "8d322173-8c0a-435d-a1a7-27d5250147bf", "value": "output.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7517c2-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150527, "uuid": "99f77025-77e7-4f79-a903-41d66f17ba38", "comment": "Malware payload (Rhadamanthys)", "value": "34fb3f61e7c0970328e0cd28efce6fd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150527, "uuid": "9e5dd3ac-01c1-4f46-b8f8-4c70dbb137fe", "comment": "Malware payload (Rhadamanthys)", "value": "eea52d2c6388e2a9075ccfbd4ca1fc34a13dee48e3a65b1b1dc3c71d7c2a7743", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150527, "uuid": "ec3b7482-3b47-48f4-8264-ea499ea962b4", "comment": "Malware payload (Rhadamanthys)", "value": "dd3573b09cc4323db8a132e9a2bbaeab0a9b5a50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150527, "uuid": "28b45bf2-06db-4c26-9406-1ce3f0c15f49", "comment": "Malware payload (Rhadamanthys)", "value": "91327721feeca10f9ae80e72199cc0ceca19ddb30f53d0da83fc0b92c75677a473ef6d3b05f31fdbb36c00ea3289e1fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150527, "uuid": "d0cdb59f-dea1-4ad2-94cb-4a67a4e5aa8d", "value": "T1EFA3F8D04E22F8E1B9363A533FD137F14979650CA24D9F02315FBBA6296498BC4D82DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150527, "uuid": "c9ebfebe-e632-42d2-8fa0-c350cf334804", "value": "1536:GDB7eKg204fNrBr64O1YoK7axAm1cLMx6BkQWJ+aY:GDB7b08dL0sMx6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150527, "uuid": "bef7d915-3c97-4003-a3aa-d64595fa741d", "value": 100149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150527, "uuid": "23801a50-f0c6-4bb7-90dd-966397c22209", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150527, "uuid": "5f56bffc-5070-480d-bc7a-32d5d927c8b8", "value": "invoice-1637482117.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76a8c62-af08-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761111322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111322, "uuid": "a9bc7cc9-5c61-4961-8b41-4ef7d4ad8b89", "comment": "Malware payload", "value": "254c291c6bdda3b1087ae8251ee97166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111322, "uuid": "43ffb902-daa3-4541-895a-1d532754b7aa", "comment": "Malware payload", "value": "ef2e62f8efe2e2188543cc333a7cb21cd1e0003909ce6710221f7de7b3c1ee27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111322, "uuid": "43a4e980-13a7-4a2e-b36f-e8a27f1b24e2", "comment": "Malware payload", "value": "35351ffd12043eae4b6481a782ca81f319fe74ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761111322, "uuid": "e75e32c3-0454-4d6a-adca-187b20d5314b", "comment": "Malware payload", "value": "f191d501995329a9c544327ed238d567956f2f6899ba758f3ba754a89a56d591d3efaf226e96fdde42a4f7d60470a2ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111322, "uuid": "05b13929-297f-45c7-ab54-5eb1c1d20bf0", "value": "T1EB463947ECA555E8C0AED63086669253BA717C494F3063D33B60F7782F76BD0AAB9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111322, "uuid": "5516d5a1-5726-4cfa-b688-1c3ee21055b4", "value": "49152:VBiXb9hDWF4wAinLyjUHvodBFKZ6aPPxvk5EHYuzxPDGP/2xt7Td4KgKCtyofADG:uDUjxKI5+EVoKmFoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761111322, "uuid": "5d2fcda8-6fe2-45a3-b393-feab436d9a72", "value": 5812376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761111322, "uuid": "15a3b8f6-599c-4926-8f97-d944d5b8dae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761111322, "uuid": "6dfbd890-fcb8-44c2-b895-95905e6f3ecd", "value": "cPanel.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c29b02-af99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761173279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173279, "uuid": "25410b9d-88ad-4dea-8b35-2c0a148cda76", "comment": "Malware payload (Mirai)", "value": "23a2f0f12e9ffede8728eb8420959cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173279, "uuid": "0403bbf3-aaac-4b7a-a58e-e990e0d683df", "comment": "Malware payload (Mirai)", "value": "efe2779f97ee6ccd7eece4e391143c64ab1aa6bbee4847cb0e7ad2a0f4edf11d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173279, "uuid": "c18834d6-31a8-4a5b-94c4-6077b6c5f9f2", "comment": "Malware payload (Mirai)", "value": "8ae32b67cc2b25b5a74970762c9ed035cafa91a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761173279, "uuid": "c9abe48e-b842-45aa-a2a6-d930eaaab7c8", "comment": "Malware payload (Mirai)", "value": "6bf3a2c669bd917333b24b863a947c1a0ac8f2b259a7feea452f5d012dc88ede78a1f805c0f99735226eae8289c09b5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173279, "uuid": "3e1d872b-46da-4e83-8ac6-6ddb081af29e", "value": "T16D143A45FC918E67C6D513BBFB5E428D372627A8D2EE32038D255F2137CA55B0E3A602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173279, "uuid": "0e895f17-c38b-4bfe-a947-d7222b60bf5d", "value": "3072:2xRZnCcFMIsKBtK5Dq8BZqG4YNY7LppmAd4oPYjSHY+bYXxbm:2xRZnCcFMIsKj6x4FnDd4/jQYOYXxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761173279, "uuid": "b5a9d075-255a-4154-85dc-5aa128cf2dfe", "value": 193184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761173279, "uuid": "31eb78a5-3199-455f-a0a3-e9d9dbbefe1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761173279, "uuid": "d610121a-5750-4f64-a3ee-321ae0d2cbdf", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d9121b-af95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761171610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171610, "uuid": "a64dab5f-4a74-493e-8ed1-4c59ae5bab73", "comment": "Malware payload (Gafgyt)", "value": "f88d5855aaf69eea3d654f7a0e5a3983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171610, "uuid": "79315b7a-15e5-4e0a-a5ce-92ac52e58ffd", "comment": "Malware payload (Gafgyt)", "value": "f07b9added7db0b9fb167b970e81a61d93a061e31d519042d7d2faa7c1b5be85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171610, "uuid": "54a5142a-680c-4192-ada3-951b8ba4c00e", "comment": "Malware payload (Gafgyt)", "value": "941aa0820adccbf34c6a50ef84bac16570c9bc6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761171610, "uuid": "c0e149fb-4599-4ecd-aab7-f0212ea63e83", "comment": "Malware payload (Gafgyt)", "value": "684b7cf3f276db3321062de2f52a3abfec869180416f79a8a89c02f3d1c6a91f36c5c3231569b4d95b3938f84579a1ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171610, "uuid": "ab2efa73-ee8f-4c06-bfb2-8cd990e68a52", "value": "T1B8630273E050BEB1FE5157F0BE45F942AF9CBF82A3C05C9921B51E526A0764C72062EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171610, "uuid": "f26958be-dfe6-49ab-b666-5c0cb67e4036", "value": "1536:MsJ024Cj+ZSH7ahYRVcEKiF6/4YTFZSsoj4u+qgw09TF:nJf4Cj+CWeIh4YDSs64u+qgwuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761171610, "uuid": "54575843-97b7-4784-a640-f30af23cd093", "value": 72128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761171610, "uuid": "180af723-4c2a-4ab5-8d92-f5e028fd07ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761171610, "uuid": "ccf57f04-c92a-42fd-914e-83eca56dca05", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f3e4ee-af63-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761150023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150023, "uuid": "50b6eb44-1515-4119-b445-ac4bc5f05c91", "comment": "Malware payload (NetSupport)", "value": "3347f71f9853bd4e2ebfb4e09ed7df48", "object_relation": "md5", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150023, "uuid": "61dff402-764b-4376-9c3c-31ce72c351fa", "comment": "Malware payload (NetSupport)", "value": "f0ec29e4a1f8a50fbb486569bf0f11dcae930f032acb06a16659e1498133dcf7", "object_relation": "sha256", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150023, "uuid": "83e139ea-a06d-4572-a9c3-4ca946666315", "comment": "Malware payload (NetSupport)", "value": "2087d7bb2af51bf8808455e0080dacd6dc5ecf9b", "object_relation": "sha1", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150023, "uuid": "991ac820-d202-4572-ac21-a7f3811c73a6", "comment": "Malware payload (NetSupport)", "value": "e9a035fe3177fe5ae7d981bffa7e5c667bdc65662fcaad1694ec546ccbc08e396b32171e31a32da891f3e8d4f786201a", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-156-153", "colour": "#3D9659", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150023, "uuid": "481ed243-e559-47e9-b0b9-12ff17e0cc55", "value": "T166B533272F8703F3753B90A9E6607F224404922C67BEB576A61B38E3787B7759311E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150023, "uuid": "e597297c-bcc5-4e54-86c4-fd276b0f3bd2", "value": "49152:B5PWZ5FvcBI66J3WM202p5GutgAJuIxyxWBvZZi9Sj:rP+U989i7JDmWg9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150023, "uuid": "f1471036-78a7-4e35-ad9e-28ec7072a0f7", "value": 2432052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150023, "uuid": "e0dd3885-c527-4a6e-8f72-6fb3973268b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150023, "uuid": "0e08a4ec-9823-4762-b530-f51b5a6f4e9c", "value": "jsoming.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51203d75-af60-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761148866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148866, "uuid": "15691126-08ed-4842-82e5-720c5a81964b", "comment": "Malware payload (Mirai)", "value": "f714228cd1da596694e22333cbda7e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148866, "uuid": "5d9ae4b7-412a-41e0-86dd-bccecd1efaab", "comment": "Malware payload (Mirai)", "value": "f17b83440ce20e42461c21afd652f6dd0cb163382dfbff5aab0835665f8eb0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148866, "uuid": "de5038a3-c7cb-45e1-bebd-bb6d3169029b", "comment": "Malware payload (Mirai)", "value": "1fea175caf1c499c517a33358f2a9b6a8a67b62a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761148866, "uuid": "8124d3f6-aafd-4328-8ab5-71c04f57249a", "comment": "Malware payload (Mirai)", "value": "de43dc8332baaa47b10a3b3f3d1d41022ad7e176a682e17d55e605624fbc457a2e2782ced86b059eb7d5876610392315", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148866, "uuid": "40273009-4419-47f2-b8a9-5eca26cc406e", "value": "T150F32A45F8518F27C6C522BBFB5E428D772617A8D2EE72039D256F24378B85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148866, "uuid": "3281441b-ff01-4833-8613-680666e4a752", "value": "3072:N1U2q5KLnfuNjmd4XIXlW4ADYc4qKfQWnuEWH:N1Ign7d441W4AD14qKI+uEWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761148866, "uuid": "bd302786-eb2e-4126-b819-11b489a59be0", "value": 161028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761148866, "uuid": "1226d9e5-771d-4c44-8ffa-c72fe29b21d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761148866, "uuid": "3cb84987-ffff-4324-9ab9-89d2975f2959", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331f5aca-af5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1761146238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761146238, "uuid": "79ffb24a-d40c-4338-a736-6d3d188581c9", "comment": "Malware payload (Gh0stRAT)", "value": "b79eb4e8be483c79777834de372aabff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "what", "colour": "#DDBE03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761146238, "uuid": "cb9ee440-1cca-4b15-8675-82feebbf1341", "comment": "Malware payload (Gh0stRAT)", "value": "f26c192f693fda7e841ec126feec2a0394a855b144877846715da1d83ddbdfeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "what", "colour": "#DDBE03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761146238, "uuid": "adc9011d-f382-4f46-8a15-a3ebb8286b09", "comment": "Malware payload (Gh0stRAT)", "value": "b83d131132f1c9eb5fca35bbb86268ed04fbbce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "what", "colour": "#DDBE03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761146238, "uuid": "f4725a53-b0be-42c7-8432-6e60f62e249b", "comment": "Malware payload (Gh0stRAT)", "value": "04b513d353aeff5fb1dbb0382e6c0fd7641f2e15585bd1bd340d1b7f9a46a92f9f05a74ffcd97af228ee32cf0d8dd3c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "what", "colour": "#DDBE03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761146238, "uuid": "221b6ecd-9248-497d-9a31-ff18b9897d32", "value": "T123F36A1774F0BBB6C34382750F658A3BB2E9E13CDD124993634B6B091F34BD28E6A251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761146238, "uuid": "9cabe982-4e6b-4591-98f0-16b76173caee", "value": "c8d8ab2105b98430234d0a20519aef66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761146238, "uuid": "ee9b2490-cf36-46e3-a1c4-d06349d97d41", "value": "3072:edlKPwx3EuRHSBtL7/u+YuzkTESlTmkhe:edlnx+7/u+YuIbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761146238, "uuid": "f2f90b0a-6189-4d1f-bdc7-6b582a001a7d", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761146238, "uuid": "646e7bfa-9313-489c-bdf7-3a093ab61da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761146238, "uuid": "82e92218-1751-4b94-8189-079eac4c801b", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db17f9d-af6c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761153933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153933, "uuid": "ee22a555-c7a2-4ace-b6ed-348473905104", "comment": "Malware payload", "value": "afc8c88ad6b89eac918dd9dec7cab949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153933, "uuid": "8071a6d6-e694-4b1e-85e8-d27e7909b918", "comment": "Malware payload", "value": "f395c932fc71ab8c2145984283490d55f895c2f47cef98a63c50cdaa8260c52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153933, "uuid": "e6023519-e896-4d83-9ae8-4fdec5e65559", "comment": "Malware payload", "value": "1be32052e5e4350b497b61f1b4895fe178b8c82e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761153933, "uuid": "48f13b8c-8f29-4c60-a964-be14c5a1a6e1", "comment": "Malware payload", "value": "602789aa203e3effdbcacd5bfc323e051d8408c96aea42aa223ee6bf92ee7fbb67edbd33f3c6ae62ecf8e28559d67fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153933, "uuid": "ba387a1b-c757-4597-a7b5-d40308601715", "value": "T1CB188E02B7975499D0AAC470C7C78763AE3178CB2B35A5EF618847352F7AAF05B38724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153933, "uuid": "4b9612d2-b6ec-413b-ba24-7a07237d813c", "value": "a82da86f23e37ec595e26aa2907643d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153933, "uuid": "8ae67cdb-63ce-45e8-8601-73ec7ffc30f1", "value": "393216:+7wnju11jzNwl8t7Q4rU2/QER53fi+ZXxVxGkAadyEY+wkpHiXUxY/iJ53IWhlV/:+EnavNwlBYeE2+5zOLuWOd85O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761153933, "uuid": "80e7d648-474b-447e-b31f-834484353a83", "value": 89927360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761153933, "uuid": "4bb7bbfd-b26f-41fc-a1f1-6f9aa863fb8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761153933, "uuid": "463f6a7e-0de5-4a25-be4e-788830e36d92", "value": "shaderblox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f1aa2b-aef5-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761102810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761102810, "uuid": "d778e229-1e2d-4311-b484-d78ccd64e98b", "comment": "Malware payload (XWorm)", "value": "d9a392caafa8e72245bd325b826e5a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761102810, "uuid": "ba0b0cb0-6b2d-4f34-aa2d-027e2993b50b", "comment": "Malware payload (XWorm)", "value": "f3ca848b708d70699ccf0802a0a9885fa8b4e183e6234e6f572bf0e46cc79495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761102810, "uuid": "0fe1a0ac-9f87-4938-b003-59a790dc65cd", "comment": "Malware payload (XWorm)", "value": "bf4d890e707fb0166a70df5b8c6830aafecbf57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761102810, "uuid": "ad2248f9-bd52-4134-9233-e42cea57a477", "comment": "Malware payload (XWorm)", "value": "6565fefc80e20f843f8a54344bd3611918ce1ef34457cdce0265229d4e4635c741e02d9eefc2078c3bfc5d02b6a0553a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761102810, "uuid": "bfc6916c-1a67-4bbd-ba13-03c3314f6086", "value": "T104B4CF9C3215F99FC883C5719A54DE74A6206DAA9307C11389E71CEFB90CE97EF180E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761102810, "uuid": "8ca07d43-f15e-4ed6-b7f3-02052a78fbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761102810, "uuid": "2b2dd5ae-dc55-4d43-96df-77dc6eef3967", "value": "12288:KedYAhukUcV50hCBeMMU+8sEZbFosjGZ0E7avQObsfv9x:KedYAVUcjC/U+s+sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761102810, "uuid": "260c6121-30e9-4b66-954a-95c8df5bc1f0", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761102810, "uuid": "1053f941-ac44-4efd-b0b2-6477a41f3f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761102810, "uuid": "15478355-af66-4a29-afd1-42879878bbea", "value": "Shipping Order - S509242880 - ISF Details - TPE59242880.XLSX.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6cd525-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150581, "uuid": "c21f43b8-6a9c-4302-8512-aedf0a115888", "comment": "Malware payload (Rhadamanthys)", "value": "b5f40707728dc3b410c436bf6cd1d657", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150581, "uuid": "0479ec22-e339-4ca8-9098-dfffb5f4f3aa", "comment": "Malware payload (Rhadamanthys)", "value": "f42b5afd2fc032ca70341be4bcccd5fdb3b7ef595539f9c661d008e98ebcdc5e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150581, "uuid": "0254e835-fe4d-448b-8e76-2133141d2992", "comment": "Malware payload (Rhadamanthys)", "value": "1f33644f872eeb38019ffd98c6c145c0ebf35ec8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150581, "uuid": "72b6332d-7627-4ac6-be33-34ee2c361e8a", "comment": "Malware payload (Rhadamanthys)", "value": "7ccc35bf55aa0c4ecfe86c7af7b6f07fad6bdbf85428eb7cf1c9af75a1426dd2b0e9fc71da738ced0b993729c27c0331", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150581, "uuid": "301c5613-81f0-4473-b8ea-6df880ad6229", "value": "T1BDA3F67076F1EF5E36D4322F2D0985A7CF1B650984246038A909776389E9E173EA70EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150581, "uuid": "ecbcf8a7-7e0e-4e7e-bb35-7ede4b20a9dc", "value": "768:GDhd0i7J4sYKgY/CMNfWdkvOrX4+rk4JYBiHs7RWkAxBGq1o4sbG5q5SLAuAAroU:GDB7eKg20Prlrk4mFNAPOf6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150581, "uuid": "7e48890f-491c-4ebf-af35-536887c13f24", "value": 101359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150581, "uuid": "a5f23910-3fb0-4a3e-84d0-cb024bc99ec1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150581, "uuid": "bd882e18-5a99-4da2-83f3-0e976c0f493b", "value": "invoice-1637482117.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0ecf0a-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150548, "uuid": "a009f20f-d186-44d1-8194-d0b760507233", "comment": "Malware payload (Rhadamanthys)", "value": "0c47e27670247c9bb9f8b5015a7a656d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150548, "uuid": "669679f4-077c-422f-a122-48ebe8031bae", "comment": "Malware payload (Rhadamanthys)", "value": "f48b3cd7523880270dd683509c711c0baca0fef46fe7433cb142091bc8f9857d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150548, "uuid": "4668ff41-05e9-43bf-b4cf-0da417dd9a08", "comment": "Malware payload (Rhadamanthys)", "value": "8aef42beeef26ff622c4371bb543fc09b43f6cc3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150548, "uuid": "7115a37b-abef-4788-9ff7-eb8fd14816f2", "comment": "Malware payload (Rhadamanthys)", "value": "486b35dc6f5c83091653dcc27afd3f35cacb537749462af064fff02dc4e26a4b2ed1155abf93efc8eca0178c5b869ee0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150548, "uuid": "4d1dbdd0-ce34-4fbb-9a55-d94efceeebce", "value": "T1D4A3F99A0D3AFFB855A6B3DF0597BDEDEC973C4139216715C81E7F02249920A6C889C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150548, "uuid": "6f8f2ca9-28cd-424d-a1db-5f93d50dc923", "value": "1536:GDB7eKg20wrwr3rnLH96ptMcGAfFYCfz6BkQWJ+aY:GDB7b0BbLqlfz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150548, "uuid": "d4d80004-0907-422a-9794-bc77bdf4d403", "value": 104771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150548, "uuid": "f360495b-a9b2-436c-848a-6ac4b3a7bd2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150548, "uuid": "28e098db-87fb-4f31-916b-7be056a0e0d4", "value": "invoice-1637482117.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f434958-af6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761154929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154929, "uuid": "dce857f5-897c-40b8-a162-4a63426675f1", "comment": "Malware payload (Mirai)", "value": "29f336a24232f527de1cdc2193b84069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154929, "uuid": "c0317c0b-005a-4d77-9857-9008b48be427", "comment": "Malware payload (Mirai)", "value": "f517173b2feab978d16335a3d0183637ea61fcee2cabff309bf581d74e8c6e25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154929, "uuid": "927aeec3-9c24-4379-b4d0-8c1df3d742ba", "comment": "Malware payload (Mirai)", "value": "e51e6eb66a61294c0dab08b7345bbefa851661dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154929, "uuid": "4eebf826-4cc5-4ada-8f37-be267c4cfc04", "comment": "Malware payload (Mirai)", "value": "b0f838f6d11b183883cf6ad95780a7b7070a59b79627d61bdb73dbff536b75041c47faa2d970af18b6ca5da6ed67002c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154929, "uuid": "3364b247-cdbc-41e3-b83a-b83c31ce0f73", "value": "T188E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154929, "uuid": "bfad73d9-ed1b-49ef-b1b9-be40f402b7f4", "value": "3072:pUkePnTUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUHb4jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154929, "uuid": "23af11e2-8566-4e49-8e6d-1cc2f363707e", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154929, "uuid": "bbd973df-b007-4a98-97f1-f0f0b3296b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154929, "uuid": "1eb75772-d2d1-4718-b58c-7252682ae713", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a064f7-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150616, "uuid": "8ca908ec-12c5-4ffa-ac3c-35ee70a0c878", "comment": "Malware payload (Rhadamanthys)", "value": "0277f6494b10ef43d56b37194f6665cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150616, "uuid": "f7d259b3-8dfb-41c9-bd15-735c653d25da", "comment": "Malware payload (Rhadamanthys)", "value": "f62636da274981288a8f186677d457c213ea52eb64ebedea68fca8d7814e7711", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150616, "uuid": "65c27f41-03dc-4b24-9e67-7ecbc340da47", "comment": "Malware payload (Rhadamanthys)", "value": "6b30e6ddce860678a6ec7800f7a10f2d17b59488", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150616, "uuid": "d02de7a8-86ca-4ee7-8ca6-f5d087708eb6", "comment": "Malware payload (Rhadamanthys)", "value": "3a543f7bd2d004677347c86c6a1f4c98135c210f892afca3a401d3b79994d65f1be9eb9a1ee8e4b7ce75c734219f85ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150616, "uuid": "9e72892b-f659-4551-abd5-366c080511d5", "value": "T1D8A329C13D16FDC131EB18955DCA7AD8ED398D50118BD4BAA72DB3FE502838C489A2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150616, "uuid": "4501207d-cfc9-4127-bf5d-bb9955ce45ef", "value": "768:GDhd0i7J4sYKgY/CMNfWdHR6rXOtr34anHFeuAIAHG1SSLAuAAroQW+FF+Ec+0FY:GDB7eKg20IrIr34al3AHMS6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150616, "uuid": "6d20d676-edc8-445c-80a4-8061db4e7df4", "value": 104107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150616, "uuid": "dfde75c7-58c0-430f-bb99-5607fd101560", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150616, "uuid": "56caeeba-4672-46df-a43f-7999d5cd9eea", "value": "invoice-1637482117.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ed430d-af97-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761172711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172711, "uuid": "6ef7c4f3-8618-4b6c-a170-60ba224f9228", "comment": "Malware payload", "value": "e81a1ed0b6442de20afbaab9bcdaa8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172711, "uuid": "284616a0-2629-481f-b9b1-a7c2fb0854ff", "comment": "Malware payload", "value": "f63078c1846acdafe24c6678fa886dfc790012d21ea80c69f861a449c8085f9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172711, "uuid": "9b3c74a1-0e33-42e3-99a2-128f357a2aef", "comment": "Malware payload", "value": "9f9bf1cfa937d67190c9a2bc89db61e486e18e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172711, "uuid": "e980419d-d0e5-4be8-95fc-a8eb7bd51d3d", "comment": "Malware payload", "value": "e66991c101453583e892bcc4a220bf28e0aa1304d795cb66b6a35a87bd89b016b4111c6332e3d89253f1bd897ce13247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172711, "uuid": "8a0aa911-0f6f-4480-8218-0186170719bf", "value": "T135347386BFA03FFFD81ECD3302959A09129D490A52D8AF7A2B34D518B64B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172711, "uuid": "5e3477a1-9e8e-46fd-a771-b8f5b4a86667", "value": "6144:2B6rXulI4EkM1wLCJ/waHQ3HLwnclk5cjOpjCnUcqXf4:yDG2O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172711, "uuid": "3437e088-8136-40dd-b9bd-cc71b0a45e46", "value": 231760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172711, "uuid": "7af76372-b7d5-48d9-b8cd-ef43240fc581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172711, "uuid": "075f225b-0a23-4375-aff0-14182784a64a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f8809d-af64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761150508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150508, "uuid": "9ba895ea-be1b-4b9f-ba63-a9472a1f5573", "comment": "Malware payload (Rhadamanthys)", "value": "0462c360c1411951f46ec49dc4ba8170", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150508, "uuid": "be530200-e052-4097-a388-e5eee72a48df", "comment": "Malware payload (Rhadamanthys)", "value": "f78fd429d2d286c29e8a16db3a58273df0258bc210fd8fb8add721927b88ebc4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150508, "uuid": "93af5e67-a3bc-4ba0-91aa-fd307c85f475", "comment": "Malware payload (Rhadamanthys)", "value": "672055802e243989e3863b82667f0369cb8ddbdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761150508, "uuid": "f16d338a-9a1a-402a-a411-77e34cab493e", "comment": "Malware payload (Rhadamanthys)", "value": "50ba9636308e4d082ffbdafe150fad2bbe3331f77c101f76a028e9c5abebe2c42051f5ac9f0d658b73ab7f1fbb2ea24a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150508, "uuid": "d56904e5-ce0f-421c-89ad-cb79f3f7a44f", "value": "T16BA3FA00A6FF7C9425DFF71B2FEB37AAE4144B639154A2414D1AF664807EB2E1C912E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150508, "uuid": "2a5cef42-5977-4984-a31d-0760552936c9", "value": "3072:GDB7b0pLxp0deiVVuEl8z5f1NPbLNoeNBOPpTkin2WnsJKMR2639AcEs+FpZMtSR:00Lxp0deiVVuEl8z5f1NPbLNoeNBOPpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761150508, "uuid": "828c1771-b0a2-4d06-9a8a-4b21d624148a", "value": 105942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761150508, "uuid": "ecbff983-a85f-43c8-8370-0e2556043ede", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761150508, "uuid": "6908d0ef-9b13-4360-ada9-69c0ddbbd074", "value": "invoice-1637482117.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07eb5f05-af1f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761120826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120826, "uuid": "ad196f6d-f0ae-4fd4-afa5-20c705058565", "comment": "Malware payload (Mirai)", "value": "be361a11d07ae3b6be2eca4bb9818144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120826, "uuid": "bbb76ee4-58ec-4e5d-bb4c-52d4abbc6044", "comment": "Malware payload (Mirai)", "value": "f7b948474533e930642d7736f37f9049cd858af6fb56a1c7ac5c66b515cb297d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120826, "uuid": "e81404f5-121b-4aca-95c6-bb0dcce44fa1", "comment": "Malware payload (Mirai)", "value": "f436e83d58a3c36de72560371bfa77c6de8ff336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761120826, "uuid": "feb32064-11a3-4bea-9636-040b772b315c", "comment": "Malware payload (Mirai)", "value": "2514edb92bd1dbfbb2e2bd04e320a854c60f2ec451672e2ac383501cddc8881c90a1186a46c9d8c7d8b183a189644fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120826, "uuid": "1eedbf32-f855-4153-968e-bf7bbc4ee03a", "value": "T1A0D3E81E6E219F7CFBD9823447B39E26A65833D637E1C585D1ACD6012E6024F281FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120826, "uuid": "d3f119ea-7163-4d6c-965a-644b70598afb", "value": "3072:mW7874ONzGE4mC7fVYToHhd96xMv+vn2w67gl/d:G4ONzGEFC7fVYToHNcMv+v7Ogl/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761120826, "uuid": "2414fa91-2ce5-47b4-90ac-cbe7e549b242", "value": 136472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761120826, "uuid": "cf9884f6-1785-4edc-87bb-022ae815d867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761120826, "uuid": "58e61359-1a70-44e6-89b0-6ffb549a6e8e", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4877f712-af0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1761112344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112344, "uuid": "aad2c2d2-18d5-4a2b-823d-81d9efa887b0", "comment": "Malware payload (Sliver)", "value": "2947301b7deee6e05cc2232337bb471f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112344, "uuid": "39c560e4-fe92-40af-bb0c-6463a4183833", "comment": "Malware payload (Sliver)", "value": "f846e895b55f398c6cc8efde97e14ba73a1d547d69237a06204fed1ec3263a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112344, "uuid": "7d44e452-36d0-4d5b-bd83-1158b5a188cc", "comment": "Malware payload (Sliver)", "value": "b8a926564c939ee7f85960c88c2c50ad3ded0ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761112344, "uuid": "8fed12dd-bb04-426a-8f7e-283e825fb760", "comment": "Malware payload (Sliver)", "value": "7e5788d3c112d5d86b41488c58988e78dc3b36fb5a02e64b9d407660ae21b0b7d2545dec09f03211d3a5b782a5f25d69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KH Nightmare", "colour": "#EE0446", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112344, "uuid": "5e238af0-93be-418c-bbd5-52815b741886", "value": "T10E071A43E8961195C4FAD1B089214262FA717C5C0B7933DF2BA5F7B42B327E48E7A790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112344, "uuid": "53e1b47b-ca99-407e-a2d4-2ebbb9ba0e63", "value": "196608:zRHKKrNECZlLxyaoSTP6hxfC7c1O8bHfjQ0r:1zuC/LNT5c1OCHfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761112344, "uuid": "f3d61d81-141e-4728-b43d-9be490750c44", "value": 18223104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761112344, "uuid": "3c4d3a84-2224-4e2b-808b-b2937ab84826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761112344, "uuid": "3c8becbf-7a56-41d9-b05e-36d70d820ead", "value": "CONDEMNED_BANQUETTE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b5c241-af92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761170435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170435, "uuid": "271a629c-0134-4263-95f3-123cf07fb856", "comment": "Malware payload (Mirai)", "value": "c15dfc986ff29ce5d552381f25b67a45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170435, "uuid": "9de170ea-776b-43db-83f6-55cd5334916f", "comment": "Malware payload (Mirai)", "value": "f849233436510053a62d62ce4733764b56662786d22efa5aef8e562202935e9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170435, "uuid": "f0c86223-5e09-4c2c-a924-345de190d960", "comment": "Malware payload (Mirai)", "value": "4f06570d7e592617a057fffaf6d90636e804e16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761170435, "uuid": "865f1d83-19f0-424f-a785-75bf2fadee48", "comment": "Malware payload (Mirai)", "value": "bfee2c459ab3a40a2483a30cbfc418eb786a2de8217d3872adab93793203b8ae0b2dac512bb8e9bbaef49dc4124c4468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170435, "uuid": "2ba6a65c-d7d7-4fff-be91-a036833e8229", "value": "T174B3F946BD818E12D4D622BAFA6E018D331267F9D3EE7112CD245F6037C695F0E73A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170435, "uuid": "2b2cc4a0-ee5f-4394-82d9-0f9a8db2caf7", "value": "3072:f4RzHQHNzgtnkiexRpIAIhRfwBxk1YdhQz28f:f4RLMNzgtkiApIAIhR4xjdE28f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761170435, "uuid": "8839f634-366a-4b01-a9d1-15bb9ffdb9b2", "value": 110392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761170435, "uuid": "662e4049-9840-4b1e-b105-0816a4083d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761170435, "uuid": "3bea1633-f6aa-4b71-a191-3b67a49a7a13", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c115ae-afa0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176502, "uuid": "e1b885dd-b4e6-4cc2-a547-7ba57eb9c5ab", "comment": "Malware payload (Mirai)", "value": "d5047df98fbc881ef796c9f82ca76e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176502, "uuid": "7bda9a7e-5a1f-4ab6-9078-9f3364981ff3", "comment": "Malware payload (Mirai)", "value": "f95e049b3300e997570b61a9a4cd148a1e35f40d679aca84abdff480df66c5da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176502, "uuid": "20eebff9-8064-476d-b8f0-7d3827185cc6", "comment": "Malware payload (Mirai)", "value": "4c804288bd4f180e87ef80616d95c4319660e9e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176502, "uuid": "498d4763-6d66-4e37-aa6e-158592643d4d", "comment": "Malware payload (Mirai)", "value": "3a0e23863cc919496a351021a7a2d67b4d29dfa00659fa0dc997c1cb41fef51a5d784c9384344d66a4ff1c67801f9a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176502, "uuid": "0a616f84-b8c3-473b-b18e-4188ee5b24a4", "value": "T1F004BFB7B70F5190CC6107F80BCB6B9D2A2365029D2786D76C6E3A3D2A370DE55123E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176502, "uuid": "aefe7fb2-f87b-4b33-ac00-25cfe3334941", "value": "3072:urQ2n6tkLvbea2EAHJBUoTRX9YW2S1yqGydpEyEegdCwY/+Xe7XmLq:urd6CbaYoPYZsdpfE1CwY/+iXQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176502, "uuid": "0bd397a2-dda4-48f9-a2ea-fbba168a3c18", "value": 181900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176502, "uuid": "af96225d-e00a-4cc0-b9d6-d3f3c3a51fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176502, "uuid": "f9fc0602-e9a8-4b0a-b720-44de416a4e7c", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735c9982-af4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761139904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139904, "uuid": "68c7720a-6104-4302-9df2-996f36b12a55", "comment": "Malware payload (Mirai)", "value": "ae6b19e43b617c810ddf3ba97d64cda6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139904, "uuid": "00b01602-1b3b-408a-aeca-15a03f8f09ee", "comment": "Malware payload (Mirai)", "value": "fa0e211c609d10a939eefbd0ae844e4c8bcf7b64caf5318cbeb908087f03f3eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139904, "uuid": "e872a52f-e655-4816-a8ee-e19cf0b14763", "comment": "Malware payload (Mirai)", "value": "939a8dd4c4224273af6c7d95a4dcf398afa23522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761139904, "uuid": "6b07fbb2-d9ea-4d88-b429-c24ff9cedd58", "comment": "Malware payload (Mirai)", "value": "df1de2159701e3b2e79aebf5a9d1abee98e77a4781e76482d2a265cc9dfc6ff2bc6d68e987ea0d084984c95ff0181c47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139904, "uuid": "20b8dcff-5617-4534-912e-57f66149b82b", "value": "T1A5E2D082A319ECD3D7A59C31FD248140F1FA6A98C6FD38279628367C86C769311FDA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139904, "uuid": "2840da10-df67-4ecb-994c-d34ca168b16d", "value": "768:dk+LC8pgSB3RYwAyVfEvq4drqt+koIxw0GPks3UozcaI:dLW8CqOi0zZ8yIxwlz/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761139904, "uuid": "fe257169-1d20-47ec-8823-a37e27aa3c10", "value": 31924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761139904, "uuid": "6b198aa6-5547-4427-9608-0c4f80a4b948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761139904, "uuid": "b299a6c9-bf5e-4b1c-bd5a-f045af85ea2e", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f35ce5-af41-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761135608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135608, "uuid": "2a49b72f-876b-41fc-a7e3-b6191de113ff", "comment": "Malware payload", "value": "579192606a8b9af6ddef7e337fa69714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135608, "uuid": "079c9889-5179-41cb-888c-97600212e597", "comment": "Malware payload", "value": "fb9d8bd979ca136937cb00ff89d3188229b02e7d693a942a057c6fbdbf4c54dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135608, "uuid": "bc2e39c1-2fae-4fad-982f-8394c209c278", "comment": "Malware payload", "value": "eb7afb13de89577ecdf8695bcf08a599475e75bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761135608, "uuid": "8aedb1d3-10c3-4c94-a1d3-e2c40112249c", "comment": "Malware payload", "value": "788893972442f8bd0a942c2ae392fa4f76fe8983adc9c660a20346ee6db29dd6f8f57ea1707ba700b49aa28d6ec5bb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135608, "uuid": "19a3ed76-c3ec-4107-9822-44aa4d9cb6eb", "value": "T17906228915C20BFCC406C7B4D8D2048C7169FBA5F8E3C69AE389D61F2F127696D6BD09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135608, "uuid": "d2e30981-7133-4ce8-bc4a-2084b5eddd32", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135608, "uuid": "03d4cc59-5c62-4361-9540-5594fed3dc80", "value": "98304:j463yykV4AYs2ccl8sJ/7nQtq4430md32NroUMijKUTGK:X3yue2cZQnuqfj2NTz7iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761135608, "uuid": "6e8de846-81a8-46c0-a69d-01fce84388f7", "value": 3886000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761135608, "uuid": "08d8347d-ec45-4cd4-9a9b-d2d5274c0724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761135608, "uuid": "1ba49ca8-c9eb-4330-aaf5-6c24e2efffa4", "value": "579192606a8b9af6ddef7e337fa69714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1110f6-af45-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761137293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137293, "uuid": "e5d76323-2aa4-472a-b949-34df76ad49e4", "comment": "Malware payload", "value": "2c24001f143b2ba09c9ebb0d21628557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137293, "uuid": "f573cbbb-ce52-4483-9b38-81a44ea7a64b", "comment": "Malware payload", "value": "fc06aaf951714240b9678b6c59297051f8835287425e5eac152d0d60e8aaa7c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137293, "uuid": "01276f55-333f-4f0e-b319-7f778b658b81", "comment": "Malware payload", "value": "28baddb06107a7b7c225d65fa32f28fdb66af4b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137293, "uuid": "7af37b30-972a-4c00-a1c6-ba6458c2b1a1", "comment": "Malware payload", "value": "88c22154b3ac49826baafea56d4674941a8f3acca3db3ea0f9d2b5431cd6b679ab88c555ea5cb241af280040ee70e880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137293, "uuid": "0c9f9941-1f85-4aff-94b4-94e83c1d5d71", "value": "T10C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137293, "uuid": "3f065c04-c5ec-42cc-80c1-503ab8b1a59c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137293, "uuid": "81f448a9-9b3a-4f24-a853-a10004fc4c37", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137293, "uuid": "d1ccfbf5-c6e2-4683-9789-3573f7a59300", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137293, "uuid": "df390c46-ba22-485b-bd95-a3b7a29160fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137293, "uuid": "3ce15793-782a-4173-a0b1-f67bfc527935", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62bb195-af44-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761137009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137009, "uuid": "063434c6-7aea-43b4-b075-73300c33d939", "comment": "Malware payload (Vidar)", "value": "5c651bd2d6a9c54fcebf9d99791051e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137009, "uuid": "7a5fa595-3655-4048-b49c-405c04542736", "comment": "Malware payload (Vidar)", "value": "fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137009, "uuid": "be8a756c-8e5d-4d69-b89e-97d431a135b9", "comment": "Malware payload (Vidar)", "value": "ef29d50f8da86571497f32a31dfc40e0eca4844d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761137009, "uuid": "8c834044-7ecc-47c9-9f57-9a8c0fb45e61", "comment": "Malware payload (Vidar)", "value": "feef29cc0aac53e8bd3fc4a15e7f157ffdcecd086ba0aa1468efe7e545c9428a278e326c892f338f6ab569cdc9e26a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137009, "uuid": "3a898ee2-a78f-4199-9c08-cbc8d01434d8", "value": "T133B53387ACB26C5DEDE07F7AED5493E9B2521894188136143C45E4F0948A2F63F713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137009, "uuid": "dbb7e381-e1fb-445f-93b1-c045b96cf141", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137009, "uuid": "8fcd3343-c199-41ba-8970-bd6a803d35f0", "value": "49152:SY0rMsVPXQ1i31lB72lZ73jaHidgapMg8VvXNiyGKFPmsQHLJ:SHMsVsiAZ72HspjGvXUyGKUJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761137009, "uuid": "4d159e14-0ad6-429c-b434-97fe2b3cb88b", "value": 2430976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761137009, "uuid": "e16a797d-c6e1-4df5-bf5d-1759170b55a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761137009, "uuid": "44fac417-bc6c-4587-b4db-bf888bca2d1b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eaa437-af3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761134143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134143, "uuid": "9842dbfa-cc01-492a-95b1-e22161d57571", "comment": "Malware payload", "value": "b648a59b0b884ec2808fc871291f0459", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134143, "uuid": "c505beff-6326-468b-8ba5-914c93babc97", "comment": "Malware payload", "value": "fc5da4c7e277322b7f40a7f17e7b30f93532b306860fff5e8523ecd30efbb0bc", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134143, "uuid": "266cd2fb-91a0-44ef-a240-0b0614e9408f", "comment": "Malware payload", "value": "67432335a8985020c8b84a7f0d0fe5964e458b7f", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761134143, "uuid": "ece1ba1c-9849-4c09-aa97-86c092d15d8b", "comment": "Malware payload", "value": "8ebfff9b41a27d6cfdfc9fff1585d78fcbef0ad62d15a73db90ebd7119ab5b195d3baf70a1e84b24d32cc0deff729e94", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134143, "uuid": "fcdba3fc-411e-4a0e-a133-1ef6b2a4d826", "value": "T17D1733039FC4E0F1856295C1A6C6DDB7BB41C14F5BCB9EE06F28886E63675CF509E248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134143, "uuid": "b96f72d1-0423-48bc-b3f5-43e5379c5130", "value": "393216:ncHbA55RFuazExJmwFUZkBCA4Os6u7u+8VmMMMhJDfk8EsMllJ/bYlSfXn:ncy5RFErqZkZKru+MmMMMTDc8EsM2lSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761134143, "uuid": "17c61c3b-846e-463a-b9ac-9a95317a3f14", "value": 20077420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761134143, "uuid": "61024d9b-c952-4d64-a405-4077cbf10995", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761134143, "uuid": "f7d34063-37ef-402d-ba98-38ae09224401", "value": "Undetected Spoofer Arc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b288f19-af6d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761154412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154412, "uuid": "cc20909a-19ff-457d-a9e9-9f746f334744", "comment": "Malware payload", "value": "71bc7613433af1d146e10e8730f77573", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154412, "uuid": "01bc128d-9257-42c1-9c9c-f10a10530bd6", "comment": "Malware payload", "value": "fc858ad30e1607f8d08f0d470b6f29d02b478651128b0ef9e6a5c91519e04862", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154412, "uuid": "816f8659-cf8b-4fcb-8de6-545cc1d4f7c8", "comment": "Malware payload", "value": "557ca00c92af61e96612c8d338364620501da208", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761154412, "uuid": "a1e87ffa-32bc-4b8c-a8ea-3a10b5f0eb36", "comment": "Malware payload", "value": "133ef93956a2336d4ce68a4bf5debd37ce94fe034fd65522d2e47d5770ac90ec3091b7c5261e33d5ea3212a2780986b5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154412, "uuid": "8628b38a-ebe9-4810-8c51-a1102e8595a7", "value": "T182D59C11B697C136C97E45712A79EB2E50BE7FA51F7444EB27E84A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154412, "uuid": "f903674c-2045-4119-8f0c-468f5b0aa7bb", "value": "49152:adQYbm9Mftgk1A3VqVZ9Rw4YP/BD/vTyPduTRUhfwEbB6zDojOwfFl5pqLOSGR0B:HYbs6AFqVPdVBqw1pqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761154412, "uuid": "344b006f-749f-4bd9-beb1-9234f401262e", "value": 2833408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761154412, "uuid": "577f5df5-2e43-4c4a-83d4-1a2a5439663e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761154412, "uuid": "7b5a4efb-84aa-4f9c-8d52-c8842b482810", "value": "SecuriteInfo.com.Other.Malware-gen.22565645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d50fabf-af97-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761172455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172455, "uuid": "52c5bee1-c685-4450-b496-5f749a93bd8c", "comment": "Malware payload (Mirai)", "value": "4950dae087dd3355957c4344b3c72058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172455, "uuid": "ee86e44f-f15a-47fd-ad75-04bf8de93511", "comment": "Malware payload (Mirai)", "value": "fe82845cf15caae647290efdbf57e7d73a3578b4f9cd6b4a6328af0ec25dd7f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172455, "uuid": "44f3bf7c-6b86-4854-83ca-5c296fac81fe", "comment": "Malware payload (Mirai)", "value": "b52ba40da3341bb766cd53d94a2c4352a39e7a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761172455, "uuid": "fb3ef787-010f-4975-bcb1-277dc987d0b2", "comment": "Malware payload (Mirai)", "value": "d37213ba65e50ce681e819c0eec03fb8f488cef71362b89cf0b7178293d4528681f1985f278969fb5918e6068c2ca3ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172455, "uuid": "eb44a74b-fea3-48cf-bdba-decb5d773d20", "value": "T1BDC32A45B9819F16D5C622FAFAAF418933136FB8D3EA7101DD206F6423CA99B0F77112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172455, "uuid": "3a85173f-9fad-4256-950e-57da449d8637", "value": "3072:5weTcXe94taQCVGldmLCa3MJm0nC69IlP8pFhcbmAk3:5weTcXeWCVGPWCa3MJm0nGlYFCbmAk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761172455, "uuid": "4066001e-b6bd-46b9-b112-c923ac01ceea", "value": 124268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761172455, "uuid": "21506d49-9b57-491b-836f-b48bd58bd809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761172455, "uuid": "a97967f4-fa81-47c2-97df-d60b7fede69c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43468e5-af36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761130966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130966, "uuid": "c159d7b3-19c5-4971-a046-68b966408ecc", "comment": "Malware payload (Mirai)", "value": "ebd2ecf527dd44d433682f63448e499d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130966, "uuid": "9e68a39f-6f7c-4bc6-8618-a77b82b5e668", "comment": "Malware payload (Mirai)", "value": "fe8aaadc8978e2ee0d17b5b1df1423793d55ff875ab8c2ae205eee41e466cc82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130966, "uuid": "a95632c1-ad2d-4b6a-8cef-8dfe5b967b92", "comment": "Malware payload (Mirai)", "value": "91fc40b9b0bb074e35bb1d8b0210cf1a64f3d6ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761130966, "uuid": "0e0c3911-8dfa-4168-91f2-0af620e68112", "comment": "Malware payload (Mirai)", "value": "2f83a2b34794c65a2a66377f9d5e208545462cb85c3a61ebd067e4d50a1c918a08d012be2e46985500530e212a2d1b40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130966, "uuid": "7d71a122-f017-417b-9781-28b94f9963bc", "value": "T1ED436B25BD762D27C0E1A07911F74B11B9B593CE26E4861E7DB20E8EFF256402603EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130966, "uuid": "9dc51955-e05e-43b9-bc80-0b2216878337", "value": "768:CuoowlEgStBq6HATYn+GCCpwENeEvO+TgKZwmJh+0V0U8Y3R9C:Cu/wlrStBq6HATYn+GCOTGmfjV043q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761130966, "uuid": "c8c13bc9-e203-4d39-9009-7b996008cd32", "value": 59792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761130966, "uuid": "befbda57-98b1-480c-8d11-2d54b294996b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761130966, "uuid": "59640a97-0abb-4c48-ac68-44df4f587320", "value": "botx.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3f65a4-af0d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761113347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113347, "uuid": "6a2bedf5-6cd9-4a24-9fe5-cb44d218a711", "comment": "Malware payload (PhantomStealer)", "value": "3defb7d002abae589079aee8bf9cf576", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113347, "uuid": "0fa143b7-7bf6-42f9-ae51-429ad9dbc793", "comment": "Malware payload (PhantomStealer)", "value": "fee6856bb295cbeddecf54585b58d55b419841f59928bc13fa8a69abf56861a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113347, "uuid": "c117b460-63ad-4328-9c58-72f0a4e99f04", "comment": "Malware payload (PhantomStealer)", "value": "fd76ecf0cea3c9fc8329f620cdd7e6e72fe5cfdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761113347, "uuid": "8995d965-1f22-40f5-a077-7ba834826bdc", "comment": "Malware payload (PhantomStealer)", "value": "6c8c90bdc007e059376dda126e8b3498dcfb73760f551f4ba98131f26ccbcb70666e1c45b6521a8d94ba151bbee90d2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113347, "uuid": "d6e9cd5e-85d6-42d5-8228-6ebf2c545f0a", "value": "T145254B20D92C47AE4E972BDDFC4106A2CDBDC604652740FCEBD90B8D62064ECE77E669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113347, "uuid": "326b5313-7056-451d-b29e-fc220f879f1c", "value": "24576:WWkc0yiv5PhB7xsZfT9mSbPrtDgUdycm6dD+qhsZWw:WWkc0yiv5PhB7xsZfT9mSbPrtDgUdycw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761113347, "uuid": "f03b0cdd-aff0-4753-8e31-35f2eca5aafa", "value": 1016375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761113347, "uuid": "5bafae2a-041c-4108-9a1f-3acc7e37a12a", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761113347, "uuid": "eecb5dde-5258-4b0f-8434-78481bd0e3db", "value": "Request for quotation-TAXC JAVS-1290080802896066_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ec2ec2-af9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761176058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176058, "uuid": "aacb0843-aa86-47f2-8e2a-854c05baaa75", "comment": "Malware payload (Mirai)", "value": "1e34c79ce59288bd3da2d966ee9c3fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176058, "uuid": "d600033e-8f29-4a7f-b9d9-0c7125bda8b0", "comment": "Malware payload (Mirai)", "value": "ff41118bba4b0a6ab66f79193e3d71a9a761e8346857a3aaf5847aaaf28c698d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176058, "uuid": "80e9fc52-3985-4e34-89ad-320c6c62adbd", "comment": "Malware payload (Mirai)", "value": "49b3968aac2b47f00f03aac8bf8bb65273502dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761176058, "uuid": "8f73900f-cc92-49e4-b9d6-91f6f5fc1083", "comment": "Malware payload (Mirai)", "value": "6f72a55567467c84d249f45db16e0fb0ea60e437c2adf93c01a4bc63c0267410ecd3c25cce9a5996b1bd58b0df5e7e85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176058, "uuid": "ccb6179c-b8c1-4e01-a935-f3c61bc4fb3f", "value": "T127B3C515BF610FF7EC5BCC734AE92B01288C751A25A93B76B930D858B64B25F15E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176058, "uuid": "2c5225b1-38d4-4541-bd9a-d788ca8e1175", "value": "1536:gRIf8YvLFVUeqQrQp/SQ9geHWRK9wRaTghZ22RZBkAyXdhQze4:gaf8YvLFVUzQUl6eHm1Z2mmdhQze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761176058, "uuid": "6396690a-3273-4b6d-9c5e-9222f5ff73d4", "value": 107896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761176058, "uuid": "077036a5-4021-4966-bc25-be7dffc2f099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761176058, "uuid": "57e58cf3-a676-40e8-9391-7cdd12258ff7", "value": "kwari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }